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Abstract 

Studies  of  offshore  and  maritime  incidents  (accidents  and  near-misses)  show  that  80%  or  more 
involve  human  error.  By  investigating  incidents,  we  can  identify  safety  problems  and  take 
corrective  actions  to  prevent  future  such  events.  While  many  offshore  and  maritime  companies 
have  incident  investigation  programs  in  place,  most  fall  short  in  identifying  and  dealing  with 
human  errors.  This  paper  discusses  how  to  incorporate  human  factors  into  an  incident 
investigation  program.  Topics  include  data  collection  and  analysis  and  how  to  determine  the 
types  of  safety  interventions  appropriate  to  safeguard  against  the  identified  risks.  Examples  are 
provided  from  three  organizations  that  have  established  their  own  human  factors  investigation 
programs. 
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manufacturers.  Trade  or  manufacturers’  names  appear  herein  solely  because  they  are 
considered  essential  to  the  object  of  this  report.  This  report  does  not  constitute  a  standard, 
specification,  or  regulation. 


Acknowledgements 

The  authors  wish  to  thank  their  organizations  for  granting  the  permission  both  to  contribute  their 
time  to  the  development  of  this  paper  and  to  share  their  organization’s  data  and  lessons  learned 
so  that  others  may  profit  from  our  experiences.  Thanks  to  Rodger  Holdsworth  and  Christy 
Franklyn  of  Risk,  Reliability  and  Safety  Engineering  for  providing  guidance  and  reviews  of  this 
paper  and  for  supplying  information,  references,  and  a  figure  used  herein.  Thanks  to  Gerry 
Miller  (G.E.  Miller  and  Associates)  for  the  clarifying  discussion  of  his  Triangle  of  Effectiveness, 
help  with  locating  references,  and  for  his  editing  suggestions.  Rachael  Gordon  contributed 
material  on  error  detection  and  recovery,  as  well  as  information  about  her  Human  Factors 
Investigation  Tool  (HFIT).  Jan  Erik  Vinnem  shared  a  presentation  on  Norway’s  offshore  near- 
miss  database.  This  paper  benefited  from  lively  discussions  at  the  April  workshop  and  from 
amplifying  information  contributed  by  Scott  Bergeron  (McDermott),  Melissa  Roberts 
(ChevronTexaco),  Sally  Caruana  (BOMEL  Ltd.),  and  Cyril  Arney  (ExxonMobil).  Thanks  also  to 
the  following  people  who  kindly  took  the  time  to  critique  a  draft  of  this  document:  Capt.  Dan 
Maurino  (International  Civil  Aviation  Organization),  Trond  S.  Eskedal  (Norwegian  Petroleum 
Directorate),  Jeffery  Thomas  (ExxonMobil),  and  James  Reason  (University  of  Manchester). 


Working  Group  1  -  HFW2002 


Page  i 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


Table  of  Contents 

Page 

1.0  Introduction . 1 

1.1  Why  Study  Incidents? . 1 

1 .2  Background  from  the  1996  International  Workshop  on  Human  Factors  in 

Offshore  Operations . 2 

1.3  The  Typical  Offshore  Incident  System  and  How  Human  Factors  Data  Can 

Enrich  It . 2 

2.0  Human  Error . 6 

2.1  Types  of  Human  Error . 7 

2.2  The  Maritime  System:  People,  Technology,  Environment,  and  Organizational 

Factors . 8 

2.3  Human  Factors  Issues  in  the  Maritime  Industry . 13 

2.3.1  Fatigue . 13 

2.3.2  Inadequate  Communications . 14 

2.3.3  Inadequate  General  Technical  Knowledge . 14 

2.3.4  Inadequate  Knowledge  of  Own  Ship  Systems . 14 

2.3.5  Poor  Design  of  Automation . 14 

2.3.6  Decisions  Based  on  Inadequate  Information . 14 

2.3.7  Poor  Judgement . 15 

2.3.8  Faulty  Standards,  Policies,  or  Practices . 15 

2.3.9  Poor  Maintenance . 15 

2.3.10  Hazardous  Natural  Environment . 15 

3.0  Building  a  Human  Factors  Incident  Investigation  Program . 15 

3.1  Keys  to  a  Successful  Human  Factors  Incident  Investigation  Program . 16 

3.1.1  An  Open,  Fair,  Improvement-Seeking  Culture . 17 

3.1 .2  Common  Understanding  of  the  Purpose  and  Scope  of  the  Incident 

Investigation  Program . 17 

3.1.3  Appropriate  Training  for  Incident  Investigators . 18 

3.1 .4  Incident  Database  Classification  Scheme . 19 

3.1 .5  Simple  Data  Entry . 20 

3.1 .6  Feedback  on  Results  of  the  Incident  Investigation  Program . 20 

3.2  Investigating  for  Human  Factors  Causes . 20 

3.3  How  an  Incident  Evolves . 21 

3.4  Improving  Safety  through  Incident  Investigation  and  Analysis . 23 


Working  Group  1  -  HFW2002 


Page  ii 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


3.5  Error  Recovery . 25 

4.0  An  Example  of  a  Human  Factors  Taxonomy:  HFACS . 26 

4.1  HFACS:  Unsafe  Acts . 28 

4.1.1  Decision  Errors . 28 

4.1 .2  Skill-based  Errors . 29 

4.1.3  Perceptual  Errors . 30 

4.1.4  Routine  Violations . 31 

4.1.5  Exceptional  Violations . 31 

4.2  HFACS:  Preconditions  for  Unsafe  Acts . 31 

4.2.1  Adverse  Mental  States . 32 

4.2.2  Adverse  Physiological  States . 33 

4.2.3  Physical/Mental  Limitations . 33 

4.2.4  Crew  Resource  Mismanagement . 34 

4.2.5  Personal  Readiness . 34 

4.3  HFACS:  Unsafe  Supervision . 35 

4.3.1  Inadequate  Supervision . 35 

4.3.2  Planned  Inappropriate  Operations . 35 

4.3.3  Failure  to  Correct  a  Known  Problem . 37 

4.3.4  Supervisory  Violations . 37 

4.4  HFACS:  Organizational  Influences . 37 

4.4.1  Resource  Management . 38 

4.4.2  Organizational  Climate . 39 

4.4.3  Organizational  Process . 39 

4.5  The  Benefits  of  Using  HFACS . 40 

5.0  Putting  It  All  Together:  Investigating  an  Incident  for  Human  Factors  Causes. 41 

5.1  Introduction . 41 

5.2  Incident  Investigation:  Going  Beyond  the  Obvious . 41 

5.3  A  Tool  for  Investigation:  Events  and  Causal  Factors  Charting . 42 

5.3.1  TORREY  CANYON  Synopsis . 43 

5.3.2  An  Event  and  Causal  Factors  Chart  of  the  TORREY  CANYON  Incident  44 

5.4  The  Art  of  Incident  Investigation . 49 

6.0  Analyzing  Incident  Data . 52 

6.1  Learning  from  Individual  Incidents . 52 

6.2  Identifying  High-Risk  Activities  or  Facilities  Using  Simple  Frequency  Analysis. ..52 

6.3  Looking  for  Trends . 53 


Working  Group  1  -  HFW2002 


Page  iii 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


6.4  Looking  for  Similar  Incidents . 55 

6.5  Determining  Under  What  Conditions  a  Given  Error  Happens . 55 

6.6  Looking  for  Underlying  Causes  Using  Meta-Analysis . 56 

6.7  Identifying  Relationships  Among  Incident  Attributes  by  Statistical  Analysis . 57 

6.8  After  the  Analysis . 58 

6.8.1  Data-Driven  Research:  the  Link  Between  Data  Analysis  and  Solving 

Safety  Problems . 59 

6.8.2  It  May  Be  Data,  But  It’s  Not  Necessarily  Telling  You  Anything . 59 

6.9  Summary  of  Analysis  Techniques . 60 

7.0  Finding  Safety  Solutions . 61 

7.1  The  Triangle  of  Effectiveness:  A  Guide  to  Safety  Interventions . 61 

7.2  Relationship  Between  Reason’s  “Slices  of  Cheese”  and  the  Triangle  of 

Effectiveness . 64 

7.2.1  Policies  &  Culture . 65 

7.2.2  Workplace  Design . 67 

7.2.3  Environmental  Control . 67 

7.2.4  Personnel  Selection . 68 

7.2.5  Training  and  Standard  Operating  Procedures  (SOPs) . 69 

7.2.6  Interpersonal  Relationships  (Communication) . 70 

7.2.7  Job  Aids . 71 

7.2.8  Fitness  for  Duty . 71 

8.0  User  Experiences  with  Starting  an  Incident  Investigation  Program . 72 

8.1  U.K.  Marine  Accident  Investigation  Branch . 72 

8.1.1  Background . 72 

8.1 .2  Events  Leading  to  Human  Factors  Investigations . 73 

8.1 .3  MAIB’s  Classification  of  Human  Factors  Causes . 73 

8.1.4  Human  Factors  Training  for  MAIB  Inspectors . 74 

8.1 .5  Benefits  of  MAIB’s  Database . 75 

8.2  California  State  Lands  Commission,  Marine  Facilities  Division . 75 

8.2.1  Background . 75 

8.2.2  Initiation  of  Human  Factors  Investigations . 76 

8.2.3  Adaptations  to  HFACS . 76 

8.2.4  Training  and  Job  Aids . 77 

8.2.5  Benefits  of  Human  Factors  Investigations . 77 

8.3  Stolt-Nielsen  Transportation  Group . 78 

8.3.1  Background . 78 


Working  Group  1  -  HFW2002 


Page  iv 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


8.3.2  Human  Factors  Incident  Investigation . 79 

8.3.3  Benefits  of  the  Incident  Database . 79 

9.0  Summary . 82 

10.0  References . 84 

Appendix  A  Sample  Incident  Reporting  Form . 90 

Appendix  B  Database  Items  on  General  Incident  Information . 93 

Appendix  C  Examples  of  Human  Factors  T axonomies . 1 01 

Appendix  D  Human  Factors  Taxonomy  Used  by  the  UK  Marine  Accident 

Investigation  Branch . 103 

Appendix  E  Adaptation  of  HFACS  by  the  California  Sate  Lands  Commission, 

Marine  Facilities  Division . 105 

Appendix  F  Stolt-Nielsen  Accident/Incident  Investigation . 1 1 3 

Appendix  G  Sample  Taxonomies  for  Investigation  for  Fatigue,  Communications 

Problems,  and  Inadequate  Skills  and  Knowledge . 115 

Appendix  H  Human  Factors  Investigation  Questions . 134 

Appendix  I  Norwegian  Petroleum  Directorate  Near-Miss  System . 139 


Working  Group  1  -  HFW2002 


Page  v 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


Table  of  Figures 

Page 

Figure  1.  Incident  Investigation  Process . 5 

Figure  2.  The  Maritime  System  Is  A  People  System . 9 

Figures.  The  Maritime  System:  People . 10 

Figure  4.  The  Maritime  System:  Effect  of  Technology  on  People . 1 1 

Figure  5.  The  Maritime  System:  Effect  of  Environment  on  People . 1 2 

Figure  6.  The  Maritime  System:  Effect  of  Organization  on  People . 12 

Figure  7.  An  Accident  in  the  Making . 22 

Figure  8.  Flow  An  Effective  Fluman  Factors  Incident  Investigation  Program  Can  Improve 

Safety . 24 

Figure  9.  The  Fluman  Factors  Classification  and  Analysis  System  (FIFACS) . 27 

Figure  10.  Classification  of  Unsafe  Acts . 29 

Figure  1 1 .  Classification  of  Preconditions  for  Unsafe  Acts . 32 

Figure  12.  Categories  of  Unsafe  Supervision . 36 

Figure  13.  Organizational  Factors  Which  Contribute  to  Incidents . 38 

Figure  14.  Events  and  Causal  Factors  Chart  for  TORREY  CANYON  Grounding . 45 

Figure  15.  The  Incident  Investigation  Process . 51 

Figure  1 6.  Example  of  a  Frequency  Analysis . 52 

Figure  17.  Example  of  a  Trend  Analysis . 54 

Figure  18.  Result  of  Statistical  Analysis  of  Incident  Database  Items . 58 

Figure  19.  The  “Triangle  of  Effectiveness”  for  Safety  Interventions . 63 

Figure  20.  Types  of  Interventions  Needed  to  Plug  the  “Floles”  in  the  Layers  of  Defenses.  ..66 

Figure  21 .  Comparison  of  Lost  Time  Injury  Rates . 80 

Figure  22.  Number  of  Incidents  as  a  Function  of  Body  Part  Injured . 81 

Figure  23.  Tools  for  an  Effective  Incident  Investigation  Program . 82 


Working  Group  1  -  HFW2002 


Page  vi 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


Human  Factors  in  Incident  Investigation  and  Analysis 


1.0  Introduction 

Traditionally,  incident  investigation  has  focused  on  hardware  issues,  such  as  material  failures 
and  equipment  malfunctions.  In  the  last  fifteen  years  or  so,  it  has  become  increasingly  evident 
that  human  factors,  rather  than  hardware  factors,  are  responsible  for  most  of  the  precursors  to 
incidents.  While  many  offshore  and  maritime  companies  have  incident  investigation  programs 
in  place,  most  consider  human  contributions  to  incidents  only  in  a  superficial  way,  if  at  all.  The 
purpose  of  this  paper  is  to  help  offshore  and  maritime  companies  incorporate  human  factors 
into  their  incident  investigation  programs  so  that  they  can  identify  human  causes  of  incidents 
and  determine  effective  safety  interventions  to  prevent  such  incidents  in  the  future. 

1 .1  Why  Study  Incidents? 

An  “accident”  is  defined  as  “an  unplanned  event  or  sequence  of  events  that  results  in 
undesirable  consequences”  (Center  for  Chemical  Process  Safety,  1992,  p.327).  Accidents 
represent  the  proverbial  “tip  of  the  iceberg”.  It  has  been  estimated  that  for  every  accident,  there 
are  about  600  near-misses^  (Det  Norske  Veritas,  1995;  Ferguson  &  Landsburg,  1998;  Bea, 
Holdsworth,  &  Smith,  1997).  Essentially,  a  near-miss  is  an  accident  that  almost  happened. 
Near-misses  and  accidents  have  the  same  causes,  so  studying  near-misses  can  help  us 
understand  safety  problems  and  make  corrective  changes  before  an  accident  takes  place.  In 
addition,  since  near-misses  do  not  result  in  full-blown  casualties,  studying  near-misses  can  help 
us  learn  how  to  develop  early-warning  systems  to  detect  when  conditions  have  become  “non¬ 
normal”  and  also  show  us  what  steps  were  taken  that  avoided  the  accident. 

Incident^  investigation  and  analysis  -  that  is,  the  study  of  accidents  and  near-misses  -  is 
squarely  in  line  with  the  intent  of  the  Internationai  Safety  Management  (ISM)  Code.  ISM 
requires  that  a  company  provide  for  a  safe  work  environment  and  safe  practices  in  maritime 
operations  and  establish  safeguards  against  all  identified  risks.  Incident  investigation  helps  the 
company  to  identify  its  risks  and  to  understand  the  underlying  causes  of  incidents.  This  in  turn 
helps  the  company  develop  safe  work  practices. 


^  A  “near-miss”  is  defined  as  “an  extraordinary  event  that  couid  reasonabiy  have  resuited  in  a  negative 
consequence  under  siightiy  different  circumstances,  but  actuaiiy  did  not”  (Center  for  Chemicai  Process 
Safety,  1992,  p.  329). 

^  An  “incident”  is  defined  as  inciuding  “aii  accidents  and  aii  near-miss  events  that  did  or  couid  cause 
injury,  or  ioss  of  or  damage  to  property  or  the  environment"  (Center  for  Chemicai  Process  Safety,  1992, 

p.  1). 


Working  Group  1  -  HFW2002 


Page  1  of  141 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


This  paper  will  help  you  to  learn  about  human  error  and  how  it  contributes  to  virtually  every 
incident.  This  paper  will  also  show  you  how  to  establish  a  human  factors  incident  investigation 
program  in  your  company  and  how  to  analyze  the  data  collected  so  that  you  can  learn  from 
incidents  and  identify  how  to  improve  your  policies  and  work  practices  to  achieve  a  higher  level 
of  safety.  Examples  are  provided  from  three  different  organizations  that  have  established  their 
own  human  factors  investigation  programs,  sharing  “lessons  learned”  and  how  the  program  has 
benefited  them. 

1.2  Background  from  the  1996  International  Workshop  on  Human  Factors  in  Offshore 
Operations 

Studies  of  accidents  and  other  incidents  on  offshore  platforms  have  indicated  that  the  vast 
majority  of  these  accidents  involve  human  error.  In  fact,  about  80%  do,  and  a  further  80%  of 
these  occur  during  operations  (Bea,  Holdsworth,  &  Smith,  1997).  The  need  to  understand  and 
control  these  human  errors  led  to  the  assemblage  of  the  1996  International  Workshop  on 
Human  Factors  in  Offshore  Operations.  The  1996  Workshop  took  a  broad  look  at  how  Human 
Factors  -  often  called  Human  and  Organizational  Factors  to  underscore  the  fact  that  most  of 
these  errors  occur  nof  within  the  span  of  control  of  the  frontline  operator,  but  are  caused  instead 
by  decisions,  policies,  and  operating  procedures  handed  down  by  higher  levels  of  the 
organization  -  affect  every  aspect  of  the  offshore  industry,  from  the  design  and  fabrication  of 
offshore  production  facilities,  to  field  operations  and  maintenance,  to  management  systems  for 
improving  safety  and  productivity.  That  Workshop  laid  the  groundwork  for  the  current 
workshop,  which  is  delving  into  more  detail  on  a  number  of  human  factors  issues,  including 
incident  investigation  and  analysis. 

The  1996  Workshop  provided  some  good  background  material  on  human  error  (Bea, 
Holdsworth,  &  Smith,  1997;  Card,  1997;  Wenk,  1997),  and  even  provided  some  tools  that  can 
be  employed  for  incident  investigation  (Bea,  1997;  Howard,  et  al.,  1997;  Kirwan,  1997;  Moore, 
et  al.,  1997;  Sclent,  Gordon,  et  al.,  1997);  these  papers  are  heartily  commended  to  the 
interested  reader.  The  present  paper  goes  into  more  detail  on  these  topics  and  focuses  the 
discussions  on:  the  understanding  of  how  human  errors  arise  and  contribute  to  incidents;  a 
specific  set  of  tools  for  representing  the  events  and  causes  of  an  incident;  dissecting  out  the 
different  levels  of  human  error;  analyzing  incident  data;  and  using  the  human  error  model  to 
select  the  most  effective  safety  interventions.  In  short,  this  paper  attempts  to  provide  the  reader 
with  a  “soup  to  nuts”  examination  of  how  to  build  a  successful  human  factors  incident 
investigation  program. 

1.3  The  Typical  Offshore  Incident  System  and  How  Human  Factors  Data  Can  Enrich  It 

Thanks,  in  part,  to  OSHA  and  ERA  regulations  on  Process  Safety  and  Risk  Management  (e.g., 
29  CFR  1910.119  and  40  CFR  Part  68)  and  to  the  International  Safety  Management  Code, 
many  offshore  and  maritime  companies  already  have  an  incident  investigation  program  in  place. 
These  programs  often  follow  well-grounded  investigative  practices,  providing  investigation  team 
members  with  training  in  the  basics  of  incident  investigation,  gathering  and  documenting 
evidence,  and  interviewing  techniques.  Many  of  these  companies  also  keep  an  incident 


Working  Group  1  -  HFW2002 


Page  2  of  141 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


database  and  may  do  frequency  and  trending  analysis.  In  short,  they  have  many  of  the 
elements  of  a  good  incident  investigation  program  already  in  place.  However,  where  most  of 
these  programs  fall  short  is  in  the  areas  of  identifying  human  factors  causes  and  determining 
how  best  to  correct  these  problems. 

While  a  number  of  companies  attempt  to  consider  “operator  errors”  during  incident 
investigations,  these  operator  errors  represent  only  the  tip  of  the  human  factors  iceberg.  As 
described  in  more  detail  in  Section  2,  most  human  factors  causes  originate  further  up  the 
organizational  chain,  taking  the  form  of  poor  management  decisions,  inadequate  staffing, 
inadequate  training,  poor  workplace  design,  etc.  Simply  identifying  the  “mistake”  an  operator 
made,  and  not  “drilling  down”  to  identify  the  underlying,  organizational  causes  of  that  mistake, 
will  not  help  to  prevent  reoccurrences  of  the  incident.  Because  most  offshore  incident 
investigation  programs  do  not  have  a  thorough  process  for  identifying  the  many  types  of  human 
error,  and  the  various  levels  of  the  organizations  from  which  such  errors  originate,  they  lack  the 
tools  with  which  to  make  effective,  human  error-reducing,  and  thus  incident-reducing,  changes. 

The  remainder  of  this  paper  will  provide  the  tools  to  understand,  investigate  for,  and 
productively  solve  human  error  causes  of  incidents: 

•  Section  2  will  describe  what  human  error  is  and  how  it  causes  incidents;  it  will  also 
discuss  some  of  the  most  pervasive  types  of  human  error  in  the  maritime  and  offshore 
industries. 

•  Section  3  outlines  the  keys  to  building  a  successful  human  factors  incident  investigation 
and  analysis  program.  It  will  describe  in  detail  the  concept  of  an  organization’s  “layers  of 
system  defenses”  against  catastrophic  events,  and  how  a  weakening  of  these  system 
defenses  can  result  in  incidents. 

•  Section  4  presents  the  Human  Factors  Analysis  and  Classification  System  (HFACS)  -  a 
simple  to  understand  and  use  system  for  categorizing  the  types  of  human  errors  at  each 
layer  of  system  defense.  HFACS  has  been  used  successfully  in  military  and  other 
industrial  applications,  and  is  compatible  with  maritime  and  offshore  needs. 

•  Section  5  walks  you  through  the  analysis  of  an  incident.  It  introduces  Events  and 
Causal  Factors  Charting,  a  method  which  first  determines  the  events  which  occurred  in 
the  evolving  incident  (similar  to  a  timeline  analysis),  and  then  considers  the  contributing 
causes  to  each  event.  The  combination  of  Events  and  Causal  Factors  Charting, 
followed  by  an  HFACS  analysis  of  the  causes,  provides  a  powerful  tools  for  ferreting  out 
the  underlying  human  error  contributions  to  an  incident. 

•  Data  analysis  is  the  topic  of  Section  6.  Several  different  approaches  are  introduced, 
allowing  companies  to  go  well  beyond  the  simple  frequency  and  trend  analysis  in 
common  usage  today.  Proactive,  thoughtful  data  analysis  is  key  to  a  company’s 
awareness  of  safety  issues  and  their  probable  underlying  causes. 

•  Finding  effective  safety  solutions  is  discussed  in  Section  7.  This  section  takes  you  from 
the  results  of  your  HFACS  and  data  analyses,  through  focused  information-gathering  on 
safety  problems,  to  crafting  effective  interventions.  The  “triangle  of  effectiveness”  is  a 


Working  Group  1  -  HFW2002 


Page  3  of  141 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


tool  that  will  help  you  to  find  the  most  effective  human  factors  interventions  and  safety 
solutions. 

•  Section  8  presents  the  “lessons  learned”  and  “success  stories”  from  three  organizations 
now  involved  in  human  factors  incident  investigation  and  analysis.  Their  experiences 
can  give  you  a  head  start  with  your  own  program. 

•  Section  9  wraps  up  the  paper  with  a  summary  of  the  most  important  points  discussed. 

•  The  Appendices  provide  you  with  sample  human  factors-related  questions  to  ask  during 
an  investigation,  additional  examples  of  human  factors  incident  investigation 
classification  schemes,  database  elements  to  capture  the  non-human  factors  relevant  to 
an  investigation,  and  specific  data  elements  that  can  help  to  identify  and  understand 
three  of  the  most  prevalent  types  of  human  error  in  maritime/offshore  accidents:  fatigue, 
inadequate  communications,  and  limitations  in  skill  and  knowledge. 

When  a  focus  on  human  error  is  incorporated  into  your  existing  incident  investigation,  analysis, 
and  intervention  program  (as  in  Fig.  1),  it  can  produce  great  benefits  for  your  company, 
including  fewer  incidents,  fewer  lost-time  accidents,  improved  employee  morale,  greater 
productivity,  and  an  overall  improvement  to  the  bottom  line. 
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Incident  Investigation  Process 
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The  Team  Leader  is  responsible  for  everything  .  .  .  Scheduling, 
/Assigning  Team  Member  Responsibilities,  Leading  the 
Brainstorming  /Activities,  Completing  the  Investigation  Report 

and  Informing  /Affected 
Employees. 

Identify  Team  Leader 
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Develop  Incident 
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How? 


A  chronological  sequence  of 
events  that  starts  on 
deviation  from  normal 
conditions  and  ends  on 
return  to  normal  conditions. 
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Causal 
Factors 
Chart 


Verify  recommendations 
eliminate  human  and  other  causal 
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Verify 
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Until  Closed 

Figure  1 .  Incident  Investigation  Process. 

(modified  from  Franklyn,  2000) 
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2.0  Human  Error^ 

Over  the  last  40  years  or  so,  the  shipping  industry  has  focused  on  improving  the  structure  of 
ships  and  platforms  and  improving  the  reliability  of  equipment  systems  in  order  to  reduce 
casualties  and  increase  efficiency  and  productivity.  Today’s  maritime  and  offshore  systems  are 
technologically  advanced  and  highly  reliable.  Yet,  the  maritime  casualty  rate  is  still  high.  The 
reason  for  this  is  because  ship/offshore  structure  and  system  reliability  are  a  relatively  small 
part  of  the  safety  equation.  The  maritime  system  is  a  people  system,  and  human  errors  figure 
prominently  in  casualty  situations.  About  75-96%  of  marine  casualties  are  caused,  at  least  in 
part,  by  some  form  of  human  error.  Studies  have  shown  that  human  error  contributes  to: 

•  84-88%  of  tanker  accidents  (T ransportation  Safety  Board  of  Canada,  1 994) 

•  79%  of  towing  vessel  groundings  (Cormier,  1 994) 

•  89-96%  of  collisions  (Bryant,  1 991 ;  U.K.  P&l  Club,  1 992) 

•  75%  of  allisions  (Bryant,  1991) 

•  75%  of  fires  and  explosions  (Bryant,  1991) 

Therefore,  if  we  want  to  make  greater  strides  towards  reducing  marine  casualties,  we  must 
begin  to  focus  on  the  types  of  human  errors  that  cause  casualties. 

One  way  to  identify  the  types  of  human  errors  relevant  to  the  maritime  and  offshore  industries  is 
to  study  incidents  and  determine  how  they  happen.  Chairman  Jim  Hall  of  the  National 
Transportation  Safety  Board  (NTSB)  has  said  that  accidents  can  be  viewed  as  very  successful 
events.  What  Chairman  Hall  means  by  “successful”  is  that  it  is  actually  difficult  to  create  an 
accident  (thank  goodness!).  Accidents  are  not  usually  caused  by  a  single  failure  or  mistake,  but 
by  the  confluence  of  a  whole  series,  or  chain,  of  errors.  In  looking  at  how  accidents  happen,  it 
is  usually  possible  to  trace  the  development  of  an  accident  through  a  number  of  discrete  events. 

A  Dutch  study  of  100  marine  casualties  (Wagenaar  &  Groeneweg,  1987)  found  that  the  number 
of  causes  per  accident  ranged  from  7  to  58,  with  a  median  of  23"*.  Minor  things  go  wrong  or  little 
mistakes  are  made  which,  in  and  of  themselves,  may  seem  innocuous.  However,  sometimes 
when  these  seemingly  minor  events  converge,  the  result  is  a  casualty.  In  the  study,  human 
error  was  found  to  contribute  to  96  of  the  100  accidents.  In  93  of  the  accidents,  multiple  human 
errors  were  made,  usually  by  two  or  more  people,  each  of  whom  made  about  two  errors  apiece. 
But  here  is  the  most  important  point:  every  human  error  that  was  made  was  determined  to  be  a 
necessary  condition  for  the  accident.  That  means  that  if  just  one  of  those  human  errors  had  not 
occurred,  the  chain  of  events  would  have  been  broken,  and  the  accident  would  not  have 
happened.  Therefore,  if  we  can  find  ways  to  prevent  some  of  these  human  errors,  or  at  least 
increase  the  probability  that  such  errors  will  be  noticed  and  corrected,  we  can  achieve  greater 
marine  safety  and  fewer  casualties. 


^  This  section  is  taken  from  Rothbium  (2000). 

*  This  means  that  haif  the  accidents  had  7-23  causes  and  the  other  haif  of  the  accidents  had  23-58 
causes. 
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2.1  Types  of  Human  Error 

What  do  we  mean  by  “human  error”?  Human  error  is  sometimes  described  as  being  one  of  the 
following:  an  incorrect  decision,  an  improperly  performed  action,  or  an  improper  lack  of  action 
(inaction).  Probably  a  better  way  to  explain  human  error  is  to  provide  examples  from  two  real 
marine  casualties. 

The  first  example  is  the  collision  of  the  M/V  SANTA  CRUZ  II  and  the  USCG  Cutter 
CUYAHOGA,  which  occurred  on  a  clear,  calm  night  on  the  Chesapeake  Bay  (Perrow,  1984). 
Both  vessels  saw  each  other  visually  and  on  radar.  So  what  could  possibly  go  wrong?  Well, 
the  CUYAHOGA  turned  in  front  of  the  SANTA  CRUZ  II.  In  the  collision  that  ensued,  1 1  Coast 
Guardsmen  lost  their  lives.  What  could  have  caused  such  a  tragedy?  Equipment 
malfunctions?  Severe  currents?  A  buoy  off-station?  No,  the  sole  cause  was  human  error. 

There  were  two  primary  errors  that  were  made.  The  first  was  on  the  part  of  the  CUYAHOGA’S 
captain:  he  misinterpreted  the  configuration  of  the  running  lights  on  the  SANTA  CRUZ  II,  and 
thus  misperceived  its  size  and  heading.  When  he  ordered  that  fateful  turn,  he  thought  he  was 
well  clear  of  the  other  vessel.  The  second  error  was  on  the  part  of  the  crew:  they  realized  what 
was  happening,  but  failed  to  inform  or  question  the  captain.  They  figured  the  captain’s 
perception  of  the  situation  was  the  same  as  their  own,  and  that  the  captain  must  have  had  a 
good  reason  to  order  the  turn.  So  they  just  stood  there  and  let  it  happen.  Another  type  of 
human  error  that  may  have  contributed  to  the  casualty  was  insufficient  manning  (notice  that  this 
is  not  an  error  on  the  part  of  the  captain  or  crew;  rather,  it  is  an  error  on  the  part  of  a 
“management”  decision-maker  who  determined  the  cutter’s  minimum  crew  size).  The  vessel 
was  undermanned,  and  the  crew  was  overworked.  Fatigue  and  excessive  workload  may  have 
contributed  to  the  captain’s  perceptual  error  and  the  crew’s  unresponsiveness. 

The  second  example  is  the  grounding  of  the  TORREY  CANYON  (Perrow,  1984).  Again  we 
have  clear,  calm  weather-this  time  it  was  a  daylight  transit  of  the  English  Channel.  While 
proceeding  through  the  Scilly  Islands,  the  ship  ran  aground,  spilling  100,000  tons  of  oil. 

At  least  four  different  human  errors  contributed  to  this  incident.  The  first  was  economic 
pressure,  that  is,  the  pressure  to  keep  to  schedule  (pressure  exerted  on  the  master  by 
management).  The  TORREY  CANYON  \NSiS  loaded  with  cargo  and  headed  for  its  deep-water 
terminal  in  Wales.  The  shipping  agent  had  contacted  the  captain  to  warn  him  of  decreasing 
tides  at  Milford  Haven,  the  entrance  to  the  terminal.  The  captain  knew  that  if  he  didn’t  make  the 
next  high  tide,  he  might  have  to  wait  as  much  as  five  days  before  the  water  depth  would  be 
sufficient  for  the  ship  to  enter. 
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This  pressure  to  keep  to  schedule  was  exacerbated  by  a  second  factor:  the  captain’s  vanity 
about  his  ship’s  appearance.  He  needed  to  transfer  cargo  in  order  to  even  out  the  ship’s  draft. 
He  could  have  performed  the  transfer  while  underway,  but  that  would  have  increased  the 
probability  that  he  might  spill  a  little  oil  on  the  decks  and  come  into  port  with  a  “sloppy”  ship.  So 
instead,  he  opted  to  rush  to  get  past  the  Scillies  and  into  Milford  Haven  in  order  to  make  the 
transfer,  thus  increasing  the  pressure  to  make  good  time. 

The  third  human  error  in  this  chain  was  another  poor  decision  by  the  master.  He  decided,  in 
order  to  save  time,  to  go  through  the  Scilly  Islands,  instead  of  around  them  as  originally 
planned.  He  made  this  decision  even  though  he  did  not  have  a  copy  of  the  Channel  P//of  for 
that  area,  and  even  though  he  was  not  very  familiar  with  the  area. 

The  final  human  error  was  an  equipment  design  error  (made  by  the  equipment  manufacturer). 
The  steering  selector  switch  was  in  the  wrong  position:  it  had  been  left  on  autopilot. 
Unfortunately,  the  design  of  the  steering  selector  unit  did  not  give  any  indication  of  its  setting  at 
the  helm.  So  when  the  captain  ordered  a  turn  into  the  western  channel  through  the  Scillies,  the 
helmsman  dutifully  turned  the  wheel,  but  nothing  happened.  By  the  time  they  figured  out  the 
problem  and  got  the  steering  selector  back  on  “manual”,  it  was  too  late  to  make  the  turn,  and 
the  TORREY  CANYON  ran  aground. 

As  these  two  examples  show,  there  are  many  different  kinds  of  human  error.  It  is  important  to 
recognize  that  “human  error”  encompasses  much  more  than  what  is  commonly  called  “operator 
error”.  In  order  to  understand  what  causes  human  error,  we  need  to  consider  how  humans  work 
within  the  maritime  system. 

2.2  The  Maritime  System:  Peopie,  Technoiogy,  Environment,  and  Organizationai 
Factors 

As  was  stated  earlier,  the  maritime  system  is  a  people  system  (Fig.  2).  People  interact  with 
technology,  the  environment,  and  organizational  factors.  Sometimes  the  weak  link  is  with  the 
people  themselves;  but  more  often  the  weak  link  is  the  way  that  technological,  environmental,  or 
organizational  factors  influence  the  way  people  perform.  Let’s  look  at  each  of  these  factors. 
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Figure  2.  The  Maritime  System  Is  A  People  System 


First,  the  people.  In  the  maritime  system  this  could  include  the  ship’s  crew,  pilots,  dock 
workers.  Vessel  Traffic  Service  operators,  and  others.  The  performance  of  these  people  will  be 
dependent  on  many  traits,  both  innate  and  learned  (Fig.  3).  As  human  beings,  we  all  have 
certain  abilities  and  limitations.  For  example,  human  beings  are  great  at  pattern  discrimination 
and  recognition.  There  isn’t  a  machine  in  the  world  that  can  interpret  a  radar  screen  as  well  as 
a  trained  human  being  can.  On  the  other  hand,  we  are  fairly  limited  in  our  memory  capacity  and 
in  our  ability  to  calculate  numbers  quickly  and  accurately-machines  can  do  a  much  better  job. 
In  addition  to  these  inborn  characteristics,  human  performance  is  also  influenced  by  the 
knowledge  and  skills  we  have  acquired,  as  well  as  by  internal  regulators  such  as  motivation  and 
alertness. 
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•  Knowledge 

•  Skills 

•  Abilities 

•  Memory 

•  Motivation 

•  Alertness 

Figure  3.  The  Maritime  System:  Peopie 


The  design  of  technology  can  have  a  big  impact  on  how  people  perform  (Fig.  4).  For  example, 
people  come  in  certain  sizes  and  have  limited  strength.  So  when  a  piece  of  equipment  meant 
to  be  used  outdoors  is  designed  with  data  entry  keys  that  are  too  small  and  too  close  together 
to  be  operated  by  a  gloved  hand,  or  if  a  cutoff  valve  is  positioned  out  of  easy  reach,  these 
designs  will  have  a  detrimental  effect  on  performance.  Automation  is  often  designed  without 
much  thought  to  the  information  that  the  user  needs  to  access.  Critical  information  is 
sometimes  either  not  displayed  at  all  or  else  displayed  in  a  manner  which  is  not  easy  to 
interpret.  Such  designs  can  lead  to  inadequate  comprehension  of  the  state  of  the  system  and 
to  poor  decision  making. 
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•  Anthropometry 

•  Reach,  strength,  agility 

•  Equipment  layout 

•  Perception  & 

•  Information  display 

comprehension 

•  Maintenance 

•  Decision-making 

•  Safety  &  performance 

Figure  4.  The  Maritime  System:  Effect  of  Technoiogy  on  Peopie 


The  environment  affects  performance,  too  (Fig.  5).  By  “environment”  we  are  including  not  only 
weather  and  other  aspects  of  the  physical  work  environment  (such  as  lighting,  noise,  and 
temperature),  but  also  the  regulatory  and  economic  climates.  The  physical  work  environment 
directly  affects  one’s  ability  to  perform.  For  example,  the  human  body  performs  best  within  a 
fairly  restricted  temperature  range.  Performance  will  be  degraded  at  temperatures  outside  that 
range,  and  fail  altogether  in  extreme  temperatures.  Fligh  sea  states  and  ship  vibrations  can 
affect  locomotion  and  manual  dexterity,  as  well  as  cause  stress  and  fatigue.  Tight  economic 
conditions  can  increase  the  probability  of  risk-taking  (e.g.,  making  schedule  at  all  costs). 

Finally,  organizational  factors,  both  crew  organization  and  company  policies,  affect  human 
performance  (Fig.  6).  Crew  size  and  training  decisions  directly  affect  crew  workload  and  their 
capabilities  to  perform  safely  and  effectively.  A  strict  hierarchical  command  structure  can  inhibit 
effective  teamwork,  whereas  free,  interactive  communications  can  enhance  it.  Work  schedules 
which  do  not  provide  the  individual  with  regular  and  sufficient  sleep  time  produce  fatigue. 
Company  policies  with  respect  to  meeting  schedules  and  working  safely  will  directly  influence 
the  degree  of  risk-taking  behavior  and  operational  safety. 
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•  Temperature,  noise 

•  Physicai  and  mentai 

•  Sea  state,  vibration 

performance 

•  Reguiations 

•  Fatigue 

•  Economics 

•  Risk-taking 

Figures.  The  Maritime  System:  Effect  of  Environment  on  Peopie 


•  Work  scheduies 

•  Fatigue 

•  Crew  compiement 

•  Knowiedge  &  skiiis 

•  Training 

•  Work  practices 

•  Communication 

•  Teamwork 

•  Safety  cuiture 

•  Risk-taking 

Figures.  The  Maritime  System:  Effect  of  Organization  on  People 
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As  you  can  see,  while  human  errors  are  all  too  often  blamed  on  “inattention”  or  “mistakes”  on 
the  part  of  the  operator,  more  often  than  not  they  are  symptomatic  of  deeper  and  more 
complicated  problems  in  the  total  maritime  system.  Human  errors  are  generally  caused  by 
technologies,  environments,  and  organizations  which  are  incompatible  in  some  way  with  optimal 
human  performance.  These  incompatible  factors  “set  up”  the  human  operator  to  make 
mistakes.  So  what  is  to  be  done  to  solve  this  problem?  Traditionally,  management  has  tried 
either  to  cajole  or  threaten  its  personnel  into  not  making  errors,  as  though  proper  motivation 
could  somehow  overcome  poorly  designed  management  and  equipment  systems  and  inborn 
human  limitations.  In  other  words,  the  human  has  been  expected  to  adapt  to  the  system.  This 
does  not  work.  Instead,  what  needs  to  be  done  is  to  adapt  the  system  to  the  human. 

The  discipline  of  human  factors  is  devoted  to  understanding  human  capabilities  and  limitations, 
and  to  applying  this  information  to  design  equipment,  work  environments,  procedures,  and 
policies  that  are  compatible  with  human  abilities.  In  this  way  we  can  design  technology, 
environments,  and  organizations  which  will  work  with  people  to  enhance  their  performance, 
instead  of  working  against  people  and  degrading  their  performance.  This  kind  of  human- 
centered  approach  (that  is,  adapting  the  system  to  the  human)  has  many  benefits,  including 
increased  efficiency  and  effectiveness,  decreased  errors  and  incidents,  decreased  training 
costs,  decreased  personnel  injuries  and  lost  time,  and  increased  morale. 

2.3  Human  Factors  Issues  in  the  Maritime  Industry 

What  are  some  of  the  most  important  human  factors  challenges  facing  the  maritime  industry 
today?  A  study  by  the  U.S.  Coast  Guard  (1995)  found  many  areas  where  the  industry  can 
improve  safety  and  performance  through  the  application  of  human  factors  principles.  Below  are 
summaries  of  the  “top  ten”  human  factors  areas  that  need  to  be  improved  in  order  to  prevent 
casualties. 

2.3.1  Fatigue 

The  NTSB  has  identified  fatigue  to  be  an  important  cross-modal  issue,  being  just  as  pertinent 
and  in  need  of  improvement  in  the  maritime  industry  as  it  is  in  the  aviation,  rail,  and  automotive 
industries.  Fatigue  has  been  cited  as  the  “number  one”  concern  of  mariners  in  two  different 
studies  (Marine  Transportation  Research  Board,  1976;  National  Research  Council,  1990).  It 
was  also  the  most  frequently  mentioned  problem  in  a  recent  Coast  Guard  survey  (U.S.  Coast 
Guard,  1995).  A  recent  study  has  objectively  substantiated  these  anecdotal  fears:  in  a  study  of 
critical  vessel  casualties^  and  personnel  injuries,  it  was  found  that  fatigue  contributed  to  16%  of 
the  vessel  casualties  and  to  33%  of  the  injuries  (McCallum,  Raby,  &  Rothblum,  1996). 


^  A  “critical”  vessel  casualty  was  defined  as  a  vessel  casualty  in  which  there  was  significant  damage  to 
the  vessel  or  property,  or  in  which  the  safety  of  the  crew  was  at  risk. 
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2.3.2  Inadequate  Communications 

Another  area  for  improvement  is  communications-between  shipmates,  between  masters  and 
pilots,  ship-to-ship,  and  ship-to-VTS.  An  NTSB  report  (National  Transportation  Safety  Board, 
1981)  stated  that  70%  of  major  marine  collisions  and  allisions  occurred  while  a  State  or  federal 
pilot  was  directing  one  or  both  vessels.  Better  procedures  and  training  can  be  designed  to 
promote  better  communications  and  coordination  on  and  between  vessels.  Bridge  Resource 
Management  (BRM)  is  a  first  step  towards  improvement. 

2.3.3  Inadequate  General  Technical  Knowledge 

In  one  study,  this  problem  was  responsible  for  35%  of  casualties  (Wagenaar  &  Groeneweg, 
1987).  The  main  contributor  to  this  category  was  a  lack  of  knowledge  of  the  proper  use  of 
technology,  such  as  radar.  Mariners  often  do  not  understand  how  the  automation  works  or 
under  what  set  of  operating  conditions  it  was  designed  to  work  effectively.  The  unfortunate 
result  is  that  mariners  sometimes  make  errors  in  using  the  equipment  or  depend  on  a  piece  of 
equipment  when  they  should  be  getting  information  from  alternate  sources. 

2.3.4  Inadequate  Knowledge  of  Own  Ship  Systems 

A  frequent  contributing  factor  to  marine  casualties  is  inadequate  knowledge  of  own  ship 
operations  and  equipment.  Several  studies  and  casualty  reports  have  warned  of  the  difficulties 
encountered  by  crews  and  pilots  who  are  constantly  working  on  ships  of  different  sizes,  with 
different  equipment,  and  carrying  different  cargoes.  The  lack  of  ship-specific  knowledge  was 
cited  as  a  problem  by  78%  of  the  mariners  surveyed  (National  Research  Council,  1990).  A 
combination  of  better  training,  standardized  equipment  design,  and  an  overhaul  of  the  present 
method  of  assigning  crew  to  ships  can  help  solve  this  problem. 

2.3.5  Poor  Design  of  Automation 

One  challenge  is  to  improve  the  design  of  shipboard  automation.  Poor  design  pervades  almost 
all  shipboard  automation,  leading  to  collisions  from  misinterpretation  of  radar  displays,  oil  spills 
from  poorly  designed  overfill  devices,  and  allisions  due  to  poor  design  of  bow  thrusters.  Poor 
equipment  design  was  cited  as  a  causal  factor  in  one-third  of  major  marine  casualties 
(Wagenaar  &  Groeneweg,  1987).  The  “fix”  is  relatively  simple:  equipment  designers  need  to 
consider  how  a  given  piece  of  equipment  will  support  the  mariner’s  task  and  how  that  piece  of 
equipment  will  fit  into  the  entire  equipment  “suite”  used  by  the  mariner.  Human  factors 
engineering  methods  and  principles  are  in  routine  use  in  other  industries  to  ensure  human- 
centered  equipment  design  and  evaluation.  The  maritime  industry  needs  to  follow  suit. 

2.3.6  Decisions  Based  on  Inadequate  Information 

Mariners  are  charged  with  making  navigation  decisions  based  on  all  available  information.  Too 
often,  we  have  a  tendency  to  rely  on  either  a  favored  piece  of  equipment  or  our  memory.  Many 
casualties  result  from  the  failure  to  consult  available  information  (such  as  that  from  a  radar  or  an 
echo-sounder).  In  other  cases,  critical  information  may  be  lacking  or  incorrect,  leading  to 
navigation  errors  (for  example,  bridge  supports  often  are  not  marked,  or  buoys  may  be  off- 
station). 
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2.3.7  Poor  Judgement 

Risky  decisions  can  lead  to  accidents.  This  category  contained  actions  that  were  not  consistent 
with  prudent  seamanship,  such  as  passing  too  closely,  excessive  speed,  and  ignoring  potential 
risks. 

2.3.8  Faulty  Standards,  Policies,  or  Practices 

This  is  an  oft-cited  category  and  covers  a  variety  of  problems.  Included  in  this  category  is  the 
lack  of  available,  precise,  written,  and  comprehensible  operational  procedures  aboard  ship  (if 
something  goes  wrong,  and  if  a  well-written  manual  is  not  immediately  available,  a  correct  and 
timely  response  is  much  less  likely).  Other  problems  in  this  category  include  management 
policies  which  encourage  risk-taking  (like  pressure  to  meet  schedules  at  all  costs)  and  the  lack 
of  consistent  traffic  rules  from  port  to  port. 

2.3.9  Poor  Maintenance 

Published  reports  (Bryant,  1991;  National  Research  Council,  1990)  and  survey  results  (US 
Coast  Guard,  1995)  expressed  concern  regarding  the  poor  maintenance  of  ships.  Poor 
maintenance  can  result  in  a  dangerous  work  environment,  lack  of  working  backup  systems,  and 
crew  fatigue  from  the  need  to  make  emergency  repairs.  Poor  maintenance  is  also  a  leading 
cause  of  fires  and  explosions  (Bryant,  1991). 

2.3.10  Hazardous  Natural  Environment 

The  marine  environment  is  not  a  forgiving  one.  Currents,  winds,  ice,  and  fog  make  for 
treacherous  working  conditions.  When  we  fail  to  incorporate  these  factors  into  the  design  of  our 
ships,  platforms,  and  equipment,  and  when  we  fail  to  adjust  our  operations  based  on  hazardous 
environmental  conditions,  we  are  at  greater  risk  for  casualties. 

These  and  other  human  errors  underlie  almost  every  maritime  incident.  By  studying  incidents  to 
understand  their  contributing  causes,  we  can  learn  how  to  redesign  our  policies,  procedures, 
work  environments,  and  equipment  to  be  more  compatible  with  our  human  users  and,  thus, 
bring  about  improved  safety  and  productivity.  In  the  next  sections  we  will  discuss  how  to 
develop  a  human  factors  incident  investigation  program  for  your  company. 


3.0  Building  a  Human  Factors  Incident  Investigation  Program 

A  well-designed  company  safety  program  is  multi-faceted.  Health,  Safety,  and  Environment 
(HSE)  management,  risk  assessment  and  management,  behavior  based  safety  management 
(BBSM),  quality  programs,  and  project  management  all  play  a  role  in  improving  safety.  A 
careful  Job  Hazards  Analysis  (JHA)  or  Job  Safety  Analysis  (JSA)  can  identify  work  hazards  and 
recommend  redesigns  of  equipment  and  work  procedures,  as  well  as  associated  precautions 
that  can  prevent  accidents. 
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Behavior  based  safety  management  and  other  related  processes  work  hand-in-hand  with 
incident  investigation  to  identify  potential  problems.  Behavior  based  safety  management  is  a 
proactive  process  which  examines  the  workplace  to  identify  problems  before  an  incident  occurs, 
while  incident  investigation  is  a  reactive  process  which  identifies  workplace  and  procedural 
hazards  that  caused  an  accident  or  near-miss.  The  data  from  both  types  of  processes  should 
be  used  together  to  gain  the  most  complete  understanding  of  potential  hazards.  The  fact  that 
both  these  processes  can  be  used  to  prevent  incidents  was  underscored  by  a  fatal  fall  that 
occurred  at  a  construction  site.  Just  prior  to  the  accident,  the  company’s  BBSM  data  had 
shown  that  personnel  were  not  hooking  up  or  using  fall  protection  properly.  The  data  also 
identified  several  barriers  to  the  safe  behavior,  including:  lack  of  available  hook  up  points;  lack 
of  available  fall  protection  in  high  hazard  areas;  lack  of  training  on  proper  use  of  protective 
equipment;  unclear  procedures;  and  discomfort  associated  with  wearing  harnesses.  By 
collecting  these  kinds  of  upstream  indicators,  a  company  can  correct  the  situation  before  an 
incident  happens. 

Unfortunately,  we’re  not  always  able  to  foresee  and  prevent  every  type  of  incident  that  might 
occur.  This  is  what  makes  incident  investigation  an  important  part  of  the  company’s  overall 
safety  strategy.  An  incident  investigation  and  analysis  program  is  essential  to  understanding 
the  underlying,  and  sometimes  hidden,  causes  of  workplace  incidents.  Proper  identification  of 
the  true  contributors  to  accidents  allows  a  company  to  establish  workable  preventive  measures. 
This  section  discusses  how  to  build  a  human  factors  incident  investigation  program. 

Additional  information  and  publications  on  human  factors  and  incident  investigation  in  the 
offshore  industry  are  offered  on  several  web  sites.  The  American  Institute  of  Chemical 
Engineers  (http://www.aiche.orq)  offers  two  documents,  “Guidelines  for  Investigating  Chemical 
Process  Incidents”  and  “International  Conference  and  Workshop  of  Process  Industry  Incidents”. 
The  U.K.’s  Health  and  Safety  Executive  (http://www.open.qov.uk/hse/hsehome.htm)  has  the 
publication  “Human  and  Organisation  Factors  in  Offshore  Safety”.  The  International  Association 
of  Oil  and  Gas  Producers  (http://www.oqp.orq.uk)  has  a  safety  incident  reporting  system  and 
incident  statistics. 

3.1  Keys  to  a  Successful  Human  Factors  Incident  Investigation  Program 

Before  we  jump  into  the  details  of  how  to  investigate  for  human  factors  causes  of  incidents,  it  is 
important  to  mention  a  few  key  factors  which  will  encourage  cooperation  in  incident 
investigations  and  will  promote  good  data  quality.  These  key  factors  are:  an  open,  fair, 
improvement-seeking  culture;  an  understanding  of  the  purpose  and  scope  of  the  incident 
investigation  program;  training  for  investigators  on  human  factors;  a  database  classification 
scheme  (taxonomy)  that  supports  the  goals  of  the  incident  investigation  program;  a  simple, 
user-friendly  way  of  entering  incident  data;  and  feedback  to  show  how  incident  data  have  been 
used  to  improve  safety  (Hill,  Byers,  &  Rothblum,  1994). 
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3.1.1  An  Open,  Fair,  Improvement-Seeking  Culture 

The  fundamental  purpose  of  an  incident  investigation  is  to  understand  the  circumstances  and 
causes  of  the  incident  with  the  aim  of  improving  safety.  We  want  to  understand:  what 
happened;  how  it  happened;  why  it  happened;  and,  most  importantly,  what  steps  can  be  taken 
to  prevent  it  from  happening  again.  Only  by  dispassionately  analyzing  the  incident  evolution  in 
detail  and  determining  its  underlying  contributing  factors  can  we  design  and  implement  effective 
remedial  actions.  It  is  important  to  remember  that  we  are  not  out  to  attribute  blame:  actions 
taken  solely  to  “blame  and  shame”  generally  do  little  to  prevent  similar  incidents  from  occurring 
in  the  future.  This  is  because,  as  discussed  in  the  previous  section,  most  incidents  are  not  the 
“fault”  of  a  given  person;  rather,  they  are  indicative  of  deficiencies  within  the  system. 
Companies  whose  incident  investigations  focus  on  “finger-pointing”  (i.e.,  identifying  the  person 
who  is  supposedly  “to  blame”  for  the  incident)  short-circuit  their  ability  to  find  and  understand 
the  rea/ causes  of  the  incident.  Only  by  analyzing  and  addressing  the  contributing  factors  -  the 
system  deficiencies  -  that  underpin  the  actions  of  those  directly  involved,  can  we  make  real 
progress  in  reducing  the  frequency  of  incidents.  Therefore,  it  is  necessary  to  foster  an  open 
and  trusting  environment  where  personnel  feel  free  to  discuss  the  evolution  of  an  incident 
without  fear  of  unjust  reprisal.  If  personnel  know  that  the  purpose  of  the  investigation  is  to 
identify  how  to  improve  safety,  and  that  the  investigation  will  lead  to  a  fair  and  objective  analysis 
of  the  incident,  they  will  be  much  more  likely  to  participate  in  a  candid  interview.  Without  such  a 
supportive  environment,  involved  individuals  will  be  reluctant  to  cooperate  in  a  full  disclosure  of 
the  events  leading  to  an  incident. 

3.1.2  Common  Understanding  of  the  Purpose  and  Scope  of  the  Incident  Investigation 
Program 

The  incident  investigation  program,  and  the  database  which  supports  it,  should  be  constructed 
to  accomplish  a  well-defined  purpose.  Program  managers  need  to  agree  on  specific  questions 
the  program  -  and,  therefore,  the  incident  database  -  will  be  expected  to  answer.  For  example, 
a  company  might  wish  to  focus  on  reducing  maintenance  incidents  which  result  in  lost  time  for 
the  employee.  Such  a  program,  and  its  database,  would  need  information  on  the  type  of 
maintenance  activity  being  performed,  the  type  of  injury  sustained  (accident)  or  narrowly 
avoided  (near-miss),  damage  to  equipment  or  workplace,  lost  time  and  money  due  to  injury  (or 
potential  loss,  in  the  case  of  a  near-miss),  and  causes  of  the  of  the  (near-)  injury  (such  as  poor 
standard  operating  procedures,  insufficient  lighting,  undermanning,  equipment  defects, 
inadequate  task  design,  lack  of  safety  policies,  etc.).  In  contrast,  a  program  focused  on 
preventing  hazardous  material  spills/emissions  could  have  a  significantly  different  set  of  factors 
of  interest  (such  as  type  of  hazmat,  regulations  violated,  location  and  size  of  spill,  fines  and 
clean-up  costs;  operational  activities  at  time  of  spill;  events  and  underlying  causes  leading  to 
the  spill).  The  point  here  is  that  the  goals  of  your  incident  investigation  program  must  drive  the 
types  of  questions  you  will  want  to  answer,  which  in  turn  dictate  the  types  of  data  you  will  collect 
during  the  investigations. 
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A  knowledge  of  the  purpose  of  the  database  will  guide  the  form  the  investigation  takes  and  will 
help  in  determining  the  appropriate  resources  to  devote  to  the  investigation.  If  certain  causal 
areas  are  known  to  be  particularly  important,  effort  will  be  concentrated  in  those  areas. 
Conversely,  if  the  investigators  do  not  understand  the  purpose  of  the  program,  they  will  shape 
their  investigations  around  their  own  biases  and  areas  of  expertise,  rather  than  around  the  goals 
of  the  program. 

Clear  guidance  is  needed  for  investigators  to  know  what  level  of  detail  is  sufficient,  and  what 
resources  are  needed  to  properly  fulfill  the  purpose  of  their  investigations  and  thoroughly  report 
their  findings.  In  the  offshore  industry  this  is  often  formalized  through  a  “charter”  which  is 
developed  at  the  beginning  of  an  incident  investigation.  The  charter  identifies  the  investigation 
team,  states  the  responsibilities  of  the  team,  its  goals  (e.g.,  to  identify  causes  or  to  develop 
recommendations),  and  a  timeline  for  the  investigation.  The  incident  investigators,  and  all 
personnel,  must  understand  the  program  goals  and  how  their  input  will  help  promote  safety 
improvements.  Only  then  will  the  investigators  know  what  types  of  data  are  important  to  collect, 
and  only  then  will  employees  understand  why  their  active  cooperation  is  important. 

3.1.3  Appropriate  Training  for  Incident  Investigators 

An  incident  investigation  program  rests  on  the  abilities  of  its  investigators.  Incident  investigation 
does  not  come  naturally:  it  must  be  trained.  Investigators  need  background  on  how  incidents 
evolve  and  the  myriad  events  and  attributes  which  can  cause  or  contribute  to  the  severity  of  an 
incident.  They  need  to  know  how  to  ask  appropriate  questions,  how  to  work  with  uncooperative 
witnesses,  how  to  build  an  events  and  causal  tree  (or  other  tool  to  help  guide  the  investigation). 
And,  of  course,  they  need  to  understand  the  specific  goals  of  the  company’s  incident 
investigation  program. 

Human  factors-related  information  is  often  overlooked  even  by  seasoned  investigators  if  they 
have  not  been  specifically  trained  to  identify  such  data.  While  it  is  both  natural  and  expected 
that  investigators  will  use  their  individual  experiences  and  unique  areas  of  expertise  (e.g., 
engineering,  navigation,  drilling)  when  conducting  investigations,  some  individuals  may  not 
have  an  adequate  perspective  to  search  for  or  recognize  human-related  causes.  A  related 
problem  is  that  if  a  human  factors  element  is  not  overlooked  entirely,  it  is  often  oversimplified.  A 
single  “obvious”  human-related  contributing  factor  may  be  identified,  such  as  “inattention”, 
without  looking  for  the  root  cause  (perhaps  information  overload,  as  a  result  of  a  poor  display 
design).  As  described  earlier,  many  external  factors  (technology,  organization,  environment) 
affect  human  performance,  and  it  takes  training  for  investigators  to  understand  and  recognize 
these  underlying  contributors. 

In  the  offshore  industry,  it  is  fairly  common  for  a  company  to  “charter”  an  incident  investigation 
team  when  an  incident  occurs.  These  ad  hoc  team  members  may  include  a  combination  of 
workers,  line  supervisors,  and  managers.  It  is  important  to  choose  a  team  that  will  be  fair, 
unbiased,  and  objective.  While  team  members  are  usually  chosen  because  of  their  experience 
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in  the  area  where  the  incident  occurred,  they  may  have  little  or  no  background  in  either  incident 
investigation  or  human  factors.  If  the  team  is  going  to  be  successful  at  identifying  the 
underlying  causes  of  the  incident,  then  at  least  some  of  the  team  members  must  have  training 
and  experience  in  human  factors  incident  investigation. 

3.1.4  Incident  Database  Classification  Scheme 

The  database  classification  scheme  (taxonomy)  must  be  directly  linked  to  the  purpose  and 
scope  of  the  incident  investigation  program.  The  database  elements  must  match  the  level  of 
detail  that  is  needed  to  answer  the  safety-related  questions  upon  which  the  program  goals  are 
based.  Too  often  an  incident  database  is  constructed  in  a  haphazard  way,  with  the  program 
managers  trying  to  think  up  data  elements  without  first  determining  the  questions  the  database 
is  meant  to  answer.  The  sad  result  is  a  database  of  little  value,  which  falls  far  short  of 
supporting  safety  improvements. 

When  it  comes  to  human  factors  information,  the  database  must  be  compatible  with  both  the 
program  goals  and  the  level  of  knowledge  of  the  investigators.  The  terminology  used  in  the 
classification  scheme  must  be  well-defined  and  understood  by  the  investigators.  In  some 
cases,  tools  may  be  needed  to  help  the  investigator  determine  whether  a  given  human  factor  is 
related  to  the  incident. 

For  example,  the  term  “fatigue”  is  very  hard  to  define  -  many  of  us  carry  our  own  beliefs  (correct 
or  incorrect)  as  to  what  fatigue  is  and  how  it  relates  to  safety.  In  order  to  obtain  reliable  and 
valid  data  on  fatigue,  it  may  be  useful  to  determine  specific  pieces  of  data  the  investigator  would 
collect  and  to  provide  an  algorithm  that  would  use  these  data  to  determine  whether  “fatigue” 
played  a  role  in  the  incident.  An  example  of  this  is  the  Fatigue  Index  Score  being  used  by  the 
U.S.  Coast  Guard  (McCallum,  Raby,  &  Rothblum,  1996;  see  App.  G):  investigators  collect  the 
number  of  hours  worked  and  slept  in  the  twenty-four  hours  preceding  the  casualty  and  also 
collect  information  on  fatigue  symptoms  (e.g.,  difficulty  concentrating,  heavy  eyelids,  desire  to 
sit  down).  These  data  are  put  into  an  equation  which  tells  the  investigator  whether  fatigue  is  a 
likely  cause,  and  therefore  whether  a  more  extensive  investigation  needs  to  be  done  to 
determine  what  contributed  to  the  fatigue.  When  the  classification  scheme  is  based  on  well- 
defined,  quantifiable  data,  it  increases  the  reliability  and  validity  of  the  human  factors  causes 
identified  (e.g.,  fatigue),  and,  more  importantly,  it  keeps  the  investigator  focused  on  why  the 
human  factors  cause  was  present  (e.g.,  insufficient  sleep  due  to  extended  port  operations). 

A  good  database  should  also  be  adaptable  to  the  changing  needs  of  the  organization.  As  the 
organization  learns  lessons  from  the  incident  data,  it  is  probable  that  additional  items  or  levels 
of  detail  will  be  desired  from  investigations,  requiring  a  modification  of  the  classification  scheme 
and  database.  One  final  note:  while  a  classification  scheme  is  extremely  helpful  for  data 
analysis,  it  can  never  capture  the  flavor  of  the  incident.  Narrative  sections  are  crucial  for  a  full 
understanding  of  the  evolution  of  the  incidents  and  for  capturing  important  information  that  just 
does  not  fit  into  the  taxonomy. 
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3.1.5  Simple  Data  Entry 

An  incident  database  should  reside  on  a  computer  system  so  that  data  analyses  can  be 
performed.  It  is  best  to  have  the  investigators  enter  their  own  incident  data,  as  a  clerk  may 
easily  misread  or  misunderstand  the  investigator’s  notes.  The  user  interface  of  the  database 
needs  to  be  efficient  and  user-friendly  in  order  to  promote  data  validity  and  completeness. 
Unfortunately,  examples  of  poor  user  interfaces  abound.  Just  as  the  classification  scheme  will 
determine  the  data  collected  and  reported,  the  computer  interface  will  determine  the  quality  of 
the  data  entered.  If  a  certain  data  field  is  required  to  be  filled  out,  it  will  always  be  filled  out, 
even  if  the  data  entered  are  of  questionable  quality.  When  the  computer  interface  is  poorly 
designed  the  system  becomes  an  obstacle  to  be  overcome,  and  effort  will  be  focused  on  just 
getting  “something”  into  the  system,  rather  than  spending  effort  on  the  veracity  and 
completeness  of  the  data  entered  (Hill,  Byers,  &  Rothblum,  1994).  A  good  incident  database 
must  be  simple  to  use,  allowing  investigators  to  enter  all  relevant  data  easily  and  completely, 
and  allowing  them  to  skip  data  fields  that  do  not  pertain  to  the  case. 

3.1.6  Feedback  on  Results  of  the  Incident  Investigation  Program 

Nothing  dulls  an  investigator’s  enthusiasm  more  than  to  be  working  hard  to  capture  useful  data, 
only  to  get  the  feeling  that  it’s  all  going  down  some  deep,  dark  hole.  Feedback  is  crucial  to  a 
successful  incident  investigation  program.  Investigators  need  to  see  the  results  of  their  work. 
And  all  personnel  need  to  know  that  the  program  is  not  just  another  “flash  in  the  pan”,  but 
something  to  which  management  has  an  on-going  commitment.  Publish  results  of  incident 
analyses,  make  specific  incidents  the  topic  of  safety  meetings,  use  the  results  to  start 
discussions  on  how  to  improve  safety,  and  let  personnel  know  that  the  new  policies  going  into 
effect  were  based  on  lessons  learned  from  incident  investigations.  When  the  use  of  the 
incident  database  is  made  public,  investigators  will  redouble  their  efforts  to  collect  complete 
data,  and  personnel  will  be  more  likely  to  cooperate  in  investigations. 

3.2  Investigating  for  Human  Factors  Causes 

Historically,  companies  and  agencies  that  investigate  incidents  have  overlooked  human  factors 
causes  almost  entirely.  Material  deficiencies  in  incidents  (for  example,  equipment  malfunction 
or  a  deficiency  in  the  structural  integrity  of  the  vessel  or  platform)  can  normally  be  readily 
identified  (e.g.,  a  shaft  is  broken  or  there’s  a  hole  in  the  hull).  However,  the  real  difficulty  in 
incident  investigation  is  to  answer  why  these  deficiencies  occurred,  and  the  answer  is  usually 
related  to  human  behavior.  For  instance,  the  shaft  may  have  broken  because  of  company 
management  decisions,  such  as  cutting  back  on  maintenance,  purchasing  a  less  costly  (and 
less  well-made)  piece  of  equipment,  or  selecting  less-experienced  engineers.  Or,  the  shaft  may 
have  broken  due  to  poor  supervision  of  operations  or  maintenance,  or  due  to  an  error  made 
during  maintenance,  or  to  someone  who  used  the  equipment  outside  its  safe  operating  range. 
Each  of  these  underlying  factors  needs  to  be  probed  for  why  W  happened,  as  well  (e.g.,  did  the 
company  cut  back  on  maintenance  to  save  money  or  to  offload  its  minimally-manned  crew? 
was  the  equipment  operated  outside  its  range  due  to  inexperience  or  willful  violation  by  the 
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operator?).  Only  after  the  investigator  understands  the  true  underlying  cause(s)  can  meaningful 
solutions  be  developed.  In  typical  investigations,  however,  the  why  \s  often  ignored. 

Another  problem  with  the  way  most  investigations  unfold  is  that  individuals  are  usually  targeted 
for  either  “incompetence”  or  for  “criminal  negligence”.  This  is  particularly  true  when  the 
investigator  discovers  that  a  given  individual  appeared  to  be  responsible  for  the  incident 
because  the  individual:  had  fallen  asleep  on  duty;  was  under  the  influence  of  alcohol  or  drugs 
on  duty;  violated  a  regulation  or  standard  operating  procedure;  appeared  to  be  inattentive;  or 
made  an  inappropriate  decision.  While  it  is  sometimes  the  case  that  an  individual  is 
incompetent  or  negligent,  the  investigator  should  always  look  for  contributing  causes  or  other 
factors  underpinning  such  behavior.  It  is  often  the  case  that  work  policies,  standard  operating 
procedures,  and  poorly  designed  jobs  or  equipment  are  at  the  core  of  the  problem.  Sanctioning 
the  individual  will  not  solve  the  problem  and  only  creates  a  culture  of  fear  and  secrecy. 
Discovering  the  real  reasons  which  underlie  a  given  incident  and  working  to  solve  the  core 
issues  will  engender  trust  and  openness  in  the  work  culture  and  lead  to  real  improvements  in 
safety. 

3.3  How  an  Incident  Evolves 

There  are  usually  multiple  causes  of  an  incident,  with  multiple  people  and  events  contributing  to 
its  evolution.  As  mentioned  in  the  Introduction,  the  accidents  studied  in  detail  by  Wagenaar  and 
Groeneweg  (1987)  had  anywhere  from  7  to  58  distinct  causes,  with  50%  of  the  cases  having  at 
least  23  causes.  We  are  often  very  good  at  identifying  the  error  most  immediately  linked  to  an 
incident.  This  is  usually  an  error  made  by  one  of  the  people  at  the  scene  of  the  incident,  such 
as  that  made  by  the  helmsman  of  the  TORREY  CANYON  when  he  failed  to  take  the  ship  off 
automatic  pilot  in  time  to  make  the  turn.  We  call  these  “active  failures”  because  they  represent 
an  action,  inaction,  or  decision  that  is  directly  related  to  the  incident.  However,  we  are  often  not 
as  good  at  identifying  other  contributing  causes,  because  many  of  these  contributing  causes 
may  have  occurred  days,  months,  or  even  years  before  the  incident  in  question.  We  call  these 
“latent  conditions”,  because  they  are  error-inducing  states  or  situations  that  are  lying  dormant 
until  the  proper  set  of  conditions  arise  which  expose  their  unsafe  attributes.  One  of  the  latent 
conditions  in  the  TORREY  CANYON  incident  was  the  poor  design  of  the  steering  selector 
switch:  it  gave  no  indication  at  the  helm  as  to  whether  steering  was  set  to  “manual”  or 
“automatic”.  An  even  more  important  latent  error  was  management  pressure  on  the  master  to 
keep  to  schedule,  for  that  sense  of  urgency  underlay  his  poor  decisions.  In  this  way  the  human 
operator  is  “set  up”  to  make  errors  because  the  latent  conditions  make  the  system  in  which  he 
works  error-inducing  rather  than  error-avoiding. 

James  Reason  (1990)  offered  a  useful  paradigm,  often  referred  to  as  the  “Swiss  cheese  model,” 
that  explains  how  the  many  types  of  contributing  factors  can  converge,  resulting  in  an  incident® 

®  Reason’s  work  underscores  the  fact  that  “human  errors”  and  “human  factors”  relate  to  the  entire 
system,  not  just  to  an  individual  operator.  The  International  Ergonomics  Association  defines  human 
factors  as  being  “concerned  with  the  understanding  of  interactions  among  humans  and  other  elements  of 
a  system.”  Further,  it  states  that  the  area  of  human  factors  considers  the  design  of  “tasks,  jobs. 
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(Fig.  7).  A  company  tries  to  promote  safety  and  prevent  catastrophic  accidents  by  putting  into 
place  layers  of  system  defenses,  depicted  in  the  figure  below  as  slices  of  Swiss  cheese. 
Essentially,  “system  defenses”  refers  to  the  safety-related  decisions  and  actions  of  the  entire 
company:  top  management,  the  line  supervisors,  and  the  workers.  The  Organizational  Factors 
layer  (slice)  represents  the  defenses  put  into  place  by  top  management.  This  level  of  system 
defenses  might  include  a  company  culture  which  puts  safety  first,  and  management  decisions 
which  reinforce  safety  by  providing  well-trained  employees  and  well-designed  equipment  to  do 
the  job.  The  second  layer  of  defenses  is  the  “Supervision”  layer.  This  refers  to  the  first-line 
supervisor  and  his  or  her  safety-consciousness  as  displayed  by  the  operational  decisions  he  or 
she  makes. 


Figure  7.  An  Accident  in  the  Making 

(after  Reason,  1990,  as  adapted  by  Wiegmann  &  Shappell,  1999) 

For  example,  a  good  supervisor  will  ensure  that  personnel  receive  the  proper  training  and 
mentoring,  that  work  crews  have  the  necessary  skills  and  work  well  together,  and  that  safety- 
related  procedures  are  used  routinely.  The  actions  and  “fitness  for  duty”  of  the  worker  make  up 
the  third  layer  of  system  defenses.  In  a  safe  system,  the  operator  is  physically  and  mentally 
ready  to  perform  and  routinely  adheres  to  safe  operating  practices  and  procedures. 


products,  environments  and  systems  in  order  to  make  them  compatible  with  the  needs,  abilities  and 
limitations  of  people.”  It  is  crucial  to  understand  that  in  a  human  factors  incident  investigation  we  are  not 
looking  to  identify  a  person  “at  fault”;  instead,  we  are  looking  primarily  for  weaknesses  in  the  links 
between  the  human  workers  and  other  parts  of  the  system,  such  as  management  policies,  equipment 
design,  and  work  environment. 
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These  system  defenses  can  slowly  erode  over  time  in  response  to  economic  pressures, 
increasing  demand  for  products  and  services,  diminishing  attention  to  promoting  a  safety 
culture,  and  others.  Each  time  safety  is  sacrificed  (e.g.,  by  cutting  back  on  preventive 
maintenance  or  by  taking  unsafe  “shortcuts”  in  operational  tasks),  it  puts  another  hole  into  that 
slice  of  cheese.  If  synergistic  reductions  in  safety  occur  at  all  three  levels  of  the  system  (that  is, 
when  the  “holes”  in  the  Swiss  cheese  line  up),  then  the  system  no  longer  has  any  inherent 
protections,  and  it  becomes  an  accident  waiting  to  happen.  All  it  takes  is  one  mistake  (unsafe 
act). 

Here’s  an  example  of  how  chipping  away  at  system  defenses  can  result  in  a  casualty.  Let’s  say 
as  a  cost-cutting  measure,  a  company  decides  to  decrease  the  inventory  of  spare  parts  on  its 
ships  (hole  in  the  Organizational  Factors  slice).  One  day  the  ship  develops  engine  problems 
from  clogged  fuel  injectors  and  doesn’t  have  sufficient  spare  parts  (this  would  be  analogous  to 
an  equipment  “precondition”).  The  captain,  knowing  that  the  company  would  penalize  him  if  he 
spent  money  to  be  towed  into  port  (hole  in  Supervision,  since  the  captain  reports  to  the 
company),  decides  to  take  a  risk  and  transit  on  only  one  engine  (Unsafe  Act).  That  engine 
fails,  and  the  vessel  drifts  and  grounds. 

3.4  Improving  Safety  through  Incident  Investigation  and  Analysis 

Maritime  and  offshore  operations  are  inherently  risky.  Company  managers  have  to  weigh  often- 
competing  interests  in  safety,  productivity,  profitability,  and  customer  expectations  in  order  to  be 
viable.  Sometimes,  well-meaning  decisions  back-fire  and  cause  unanticipated  safety  problems. 
One  way  management  can  keep  its  finger  on  the  safety  pulse  of  the  company  is  through 
incident  investigation  and  analysis.  As  Fig.  8  shows,  by  thoroughly  investigating  incidents  and 
the  human  errors  that  cause  them,  one  can  identify  the  holes  in  the  system  defenses  and 
develop  workable  solutions. 

An  incident  investigation  program  consists  of  five  components  (Fig.  8).  First,  the  company  must 
support  the  investigation  of  incidents.  This  requires  objective  investigators  with  at  least  a 
minimal  amount  of  training  in  investigation  techniques  and  a  firm  understanding  of  the  purpose 
of  the  investigation  and  the  types  of  data  which  must  be  collected  to  support  the  company’s 
objectives.  Second,  the  company  must  develop  and  maintain  an  incident  database.  As 
mentioned  earlier,  such  a  database  should  be  computerized  for  easier  analysis.  The  database 
must  be  composed  of  a  set  of  taxonomies  (classification  schemes)  which  will  capture  the 
incident  elements  of  interest  to  the  company.  The  database  should  also  incorporate  narrative 
fields  so  that  investigators  can  explain  events  and  causes  in  more  detail.  Third,  the  company 
must  then  support  regular  analysis  of  the  incidents  in  the  database.  As  will  be  discussed  in 
more  detail  later,  analysis  allows  the  company  to  find  patterns  common  to  a  group  of  incidents, 
and  allows  the  determination  of  how  frequently  different  types  of  incidents  occur  and,  in  the 
case  of  near-misses,  the  potential  severity  of  the  accident  that  was  avoided.  Such  data  are  very 
helpful  in  targeting  the  types  of  safety  problems  that  the  company  will  want  to  spend  time  and 
money  to  solve. 
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Figure  8.  How  An  Effective  Human  Factors  Incident  Investigation  Program 

Can  Improve  Safety 

(Modified  from  Wiegmann  and  Shappeii,  1999) 


The  fourth  component  of  a  successfui  incident  investigation  program  is  data-driven  research, 
incident  investigation  wiii  frequentiy  just  “skim  the  surface”  of  a  safety  probiem.  The  vaiue  of 
incident  investigation  and  anaiysis  is  that  it  identifies  areas  of  concern,  in  most  cases,  incident 
investigation  and  anaiysis  wiii  not  be  sufficient  to  “soive”  the  probiem.  Soiving  the  probiem  wiii 
require  getting  more  information  on  the  poiicies,  standard  operating  procedures,  common  work 
practices,  equipment  and  job  design,  and  empioyee  attributes  (iike  training,  preparedness, 
physicai  and  mentai  condition)  iinked  to  the  activities  or  situations  in  which  the  incidents  have 
occurred.  The  “research”  might  take  the  form  of  a  risk  assessment,  or  it  may  require  the 
coiiection  of  additionai,  detaiied  information  in  subsequent  investigations  of  reiated  incidents,  or 
perhaps  a  comparison  of  current  company  poiicies  and  practices  with  those  empioyed  by  other 
companies  (“benchmarking”).  Through  research,  the  company  gains  a  more  compiete 
understanding  of  aii  the  various  contributing  factors  which  drive  the  incidents  of  interest.  The 
research  might  then  extend  to  a  comparison  of  the  effectiveness  of  different  prevention 
methods. 
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Finally,  the  result  of  the  research  step  is  an  addition  to  or  a  revision  of  the  company’s  safety 
program.  Using  the  concept  of  “barrier  analysis”  (Hollnagel,  2000),  the  company  wants  to 
understand  how  safety  failures  arise  and  implement  “barriers”  (such  as  equipment  “shields”  to 
protect  workers  from  exposure  to  potential  harm,  or  procedures  which  prevent  activities  known 
to  be  hazardous)  to  prevent  incidents.  Successful  prevention  can  eliminate  certain  hazards. 
Other  incident  causes  may  not  be  easily  prevented,  but  there  may  be  ways  to  mitigate  (reduce) 
their  consequences.  When  a  safety  program  acts  on  the  incident  data  which  contains 
underlying  causes,  it  will  be  effective. 

3.5  Error  Recovery 

Error  recovery  is  an  important  supplementary  safety  goal,  and  will  be  mentioned  briefly  here. 
Many  offshore  companies  have  a  “zero  accidents”  policy  which,  while  the  ultimate  safety  goal, 
may  be  difficult  to  fully  attain  (Kontogiannis,  1999).  In  some  industries,  systems  are  being 
developed  which  focus  on  preventing  the  consequences  of  human  error  by  providing 
opportunities  for  error  recovery  (Helmreich,  et  al.,  2000;  Sasou  &  Reason,  1999). 

A  framework  developed  by  Kontogiannis  (1999)  categorizes  error  recovery  according  to  the 
process  used,  the  outcome,  and  the  stage  of  performance.  The  process  is  usually  either 
detection,  explanation,  or  correction.  For  example,  if  you  are  using  a  word  processor  and 
misspell  a  word,  one  option  for  the  spell  check  function  is  to  merely  detect  the  misspelled  word 
and  allow  the  user  to  decide  what,  if  anything,  to  do  about  it.  A  different  option  has  the  spell 
checker  both  detect  and  expiain  or  suggest  options  for  correcting  the  word.  Some  word 
processors  are  even  capable  of  correction,  by  automatically  detecting  and  correcting 
misspellings  as  you  type.  Similar  detection,  explanation,  and  correction  features  can  be  built 
into  offshore  and  maritime  systems,  either  through  automation  or  through  procedures. 

Outcomes  of  the  recovery  process  refer  to  the  state  of  the  system  after  recovery.  For  example, 
an  error-detecting  system  might  block  the  error  from  happening  and  return  the  system  to  its 
original  state  prior  to  the  error  (this  is  called  backward  recovery).  The  stage  of  performance 
relates  to  the  stage  in  which  the  error  detection  was  made.  For  example,  the  outcome  stage 
would  be  where  an  error  is  detected  based  on  a  mismatch  between  the  expected  outcomes  of  a 
process  and  the  outcomes  actually  observed.  For  instance,  if  there  is  a  low  pressure  reading 
and  the  operator  erroneously  turns  the  valve  in  the  wrong  direction,  the  outcome  will  be  an  even 
lower  pressure.  An  error  detector  in  the  outcome  stage  would  note  the  discrepancy  between 
the  present  pressure  reading  and  the  higher  pressure  that  was  intended,  and  signal  the  error. 

A  simplified  version  of  this  framework  is  being  used  in  a  U.K.  oil  industry  research  project 
developing  a  human  factors  investigation  tool  (FIFIT  -  see  App.  C;  Gordon,  Flin  &  Mearns, 
2001).  Investigators  are  asked  three  questions  regarding  the  possible  recovery  process  of  the 
error:  was  the  error  detected  (realized  or  suspected),  was  it  understood  why  the  error  occurred, 
and  was  it  corrected  (e.g.,  by  modifying  an  existing  plan  or  developing  a  new  plan)?  Flow  the 
error  was  detected  (e.g.,  via  system  feedback,  external  communications,  etc.)  is  also  discussed. 
By  including  these  types  of  questions  into  an  incident  investigation,  it  may  illuminate  changes  to 
equipment  or  procedures  which  may  act  to  prevent  such  errors  in  the  future. 
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4.0  An  Example  of  a  Human  Factors  Taxonomy:  HFACS^ 

An  effective  incident  database  has  at  its  heart  a  set  of  classification  schemes  or  taxonomies: 
schemes  to  classify  the  type  of  incident,  the  type  of  people  involved  in  the  incident,  the  type  of 
platform  or  vessel  involved,  the  geographical  area  and  weather  conditions,  the  type  of 
equipment  that  failed,  the  activities  occurring  at  the  time  of  the  incident,  and  of  course,  the 
human  factors  causes.  A  maritime  example  with  all  these  components  and  more  is  the 
International  Maritime  Incident  Safety  System  (IMISS;  Rothblum,  Chaderjian,  &  Mercier,  2000; 
see  App.  B).  It  is  important  to  understand  all  of  the  different  types  of  factors  (equipment, 
human,  weather,  etc.)  involved  in  an  incident.  Since  the  offshore  and  maritime  industries 
already  have  adequate  ways  of  identifying  equipment  and  other  non-human  contributions  to 
incidents,  this  section  will  focus  only  on  the  identification  and  classification  of  human  factors 
causes. 

There  are  many,  many  human  factors  taxonomies  that  are  in  use  by  NASA,  the  Nuclear 
Regulatory  Commission,  the  Transportation  Safety  Board  of  Canada,  the  U.K.  Marine  Accident 
Investigation  Branch,  and  others.  Some  of  these  are  listed  in  Appendix  C;  they  are  all  useful 
taxonomies.  These  taxonomies  vary  with  respect  to  how  they  chose  to  group  human  factors 
elements,  the  level  of  detail  they  provide,  and  the  level  of  expertise  required  on  the  part  of  the 
investigator. 

In  order  to  provide  an  example  of  a  human  factors  taxonomy  and  to  show  how  it  would  be  used 
during  an  investigation,  we  selected  the  Human  Factors  Analysis  and  Classification  System 
(HFACS;  Shappell  &  Wiegmann,  1997a,  2000;  Wiegmann  &  Shappell,  1999)  because  it  is 
relatively  easy  to  learn  and  use,  and  because  its  effectiveness  has  been  demonstrated  through 
its  use  by  the  U.S.  Navy  and  U.S.  Marine  Corps  for  aviation  accident  investigation  and  analysis. 
This  classification  scheme,  as  well  as  several  of  the  others  mentioned,  is  based  on  the  well- 
established  human  error  frameworks  of  the  SHEL  model  (Software-Hardware-Environment- 
Liveware;  Edwards  (1972)  and  Hawkins  (1984,  1987)  as  cited  in  TSB,  1998),  Rasmussen’s 
taxonomy  of  errors  (1987,  as  cited  in  TSB,  1998),  and  Reason’s  (1990)  “Swiss  cheese”  model 
of  accident  causation. 

HFACS  seeks  to  understand  all  the  human-related  contributing  causes  to  an  incident  by 
considering  the  “holes”  in  the  four  layers  of  system  defenses:  unsafe  acts,  preconditions  for 
unsafe  acts  (unsafe  conditions),  unsafe  supervision,  and  organizational  factors  (see  Fig.  9). 
The  discussion  below  summarizes  some  of  the  types  of  latent  conditions  and  active  failures 
associated  with  these  layers  of  system  defenses.  For  more  information,  please  see  Shappell  & 
Wiegmann  (1997a,  2000)  or  Wiegmann  &  Shappell  (1999). 


^  The  majority  of  this  section  has  been  taken  from  Shappeii  &  Wiegmann  (2000).  For  additionai 
information  about  HFACS,  or  to  take  a  seminar  on  HFACS,  piease  contact  either  Dr.  Scott  Shappeii  at 
scott  shappeii@mmacmaii.iccbi.aov  and  (405)  954-4082,  or  Dr.  Doug  Wiegmann  at 

dwieaman(5)uiuc.edu  and  (217)  244-8637. 
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Figure  9.  The  Human  Factors  Classification  and  Analysis  System  (HFACS) 
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4.1  HFACS:  Unsafe  Acts 

In  an  incident  investigation,  the  investigator  starts  with  the  immediate  actions  and  events 
surrounding  the  incident  and  then  works  backwards  to  uncover  contributing  causes.  In  terms  of 
human  errors,  those  immediately  linked  to  the  incident  are  typically  “unsafe  acts”.  There  are 
two  types  of  unsafe  acts:  errors  and  violations. 

Errors  represent  the  mental  and  physical  activities  of  individuals  that  fail  to  achieve  their 
intended  outcome;  that  is,  the  result  of  the  person’s  action  was  not  as  expected.  For  example,  if 
the  captain  orders  “right  20  degrees”  when  he  meant  to  order  “left  20  degrees”,  that  would  be  an 
error.  A  violation,  on  the  other  hand,  is  when  the  person’s  action  reflects  a  willful  disregard  for 
standard  operating  procedures  or  regulations  (even  though  they  probably  did  not  intend  to 
cause  an  incident).  For  example,  an  engineer  doing  maintenance  might  decide  to  “cut  corners” 
and  not  perform  a  maintenance  procedure  the  way  it  should  be  done.  Flis  performance  is  an 
intentional  violation  of  the  correct  procedure.  Errors  and  violations  can  be  further  subdivided, 
as  shown  in  Figure  10.  Errors  can  be  decision  errors,  skill-based  errors,  or  perceptual  errors. 
Violations  can  be  routine  or  exceptional. 

4.1.1  Decision  Errors 

The  decision  error  represents  an  activity  or  behavior  that  proceeds  as  intended,  yet  the  plan 
proves  inadequate  or  inappropriate  for  the  situation.  Often  referred  to  as  “honest  mistakes,” 
these  unsafe  acts  represent  the  actions  or  inactions  of  individuals  whose  “hearts  are  in  the  right 
place,”  but  they  either  did  not  have  the  appropriate  knowledge  or  just  simply  made  a  poor 
choice.  These  types  of  knowledge-based  and  rule-based  errors  have  been  referred  to  in 
Reason’s  taxonomy  as  “mistakes”  (TSB,  1998). 

Decision  errors  can  result  from  multiple  causes.  For  example,  a  wrong  decision  can  be  made  if 
the  person  does  not  fully  understand  the  situation  at  hand,  misdiagnoses  the  problem,  and 
proceeds  to  apply  the  wrong  “solution”  (because  he’s  solving  the  wrong  problem). 
Troubleshooting  an  electrical  fault  could  lead  to  this  type  of  procedural  decision  error.  Decision 
errors  can  also  occur  if  the  person  does  not  have  sufficient  experience  to  guide  his  decision,  or 
if  there  is  not  enough  time  to  fully  work  through  the  problem  properly  before  a  choice  must  be 
made  (called  a  choice  decision  error).  Problem-solving  errors  can  occur  when  the  problem  is  a 
novel  one,  requiring  the  person  to  reason  through  it. 
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Figure  10.  Classification  of  Unsafe  Acts 

(modified  from  Shappell  &  Wiegmann,  2000,  and  TSB,  1998) 


4.1.2  Skill-based  Errors 

Skill-based  errors  can  occur  in  the  execution  of  skills  or  procedures  that  have  become  so  well- 
learned  that  they  are  performed  almost  automatically.  Routine  maintenance  tasks,  taking 
navigational  bearings,  monitoring  equipment  displays,  and  other  repetitive  operations  would  be 
considered  skill-based  tasks.  These  types  of  tasks  are  sometimes  performed  improperly  due  to 
a  failure  of  attention  or  memory.  Consider  the  hapless  soul  who  locks  himself  out  of  the  car  or 
misses  his  exit  because  he  was  either  distracted,  in  a  hurry,  or  daydreaming.  These  are  both 
examples  of  attention  failures  that  commonly  occur  during  highly  automatized  behavior.  Types 
of  attention  failures  include  omitting  a  step  in  a  procedure,  reversing  the  order  of  two  steps,  or 
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doing  the  right  thing  at  the  wrong  time.  Attentional  deficits  can  also  result  in  failing  to  detect  a 
problem  while  monitoring  equipment. 

In  contrast  to  attention  failures,  memory  failures  often  appear  as  omitted  items  in  a  checklist, 
place  losing,  or  forgotten  intentions.  Failures  in  memory  can  result  in  forgetting  to  do  a  planned 
activity  or  losing  one’s  place  in  a  series  of  tasks.  For  example,  most  of  us  have  experienced 
going  to  the  refrigerator  only  to  forget  what  we  went  for.  Likewise,  it  is  not  difficult  to  imagine 
that  when  under  stress  during  an  operational  emergency,  critical  steps  in  the  emergency 
procedures  can  be  missed.  Even  when  not  particularly  stressed,  individuals  can  forget  to 
complete  certain  steps  within  a  procedure. 

If  one  of  these  types  of  errors  is  found  during  an  incident  investigation,  it  is  a  signal  to  look 
deeper.  Merely  telling  an  operator  to  “pay  better  attention  next  time”  will  not  solve  the  problem. 
These  types  of  errors  are  symptoms  of  underlying  system  failures.  Take,  for  example,  the  fatal 
accident  aboard  the  RIX  HARRIER  (MAIB,  1997).  On  a  July  afternoon,  the  vessel  was  being 
moored  to  a  jetty  on  the  River  Flumber.  A  mooring  rope  had  been  led  around  a  fairlead,  which 
was  situated  on  top  of  the  aft  bulwark  rail.  As  the  rope  tightened,  it  sprang  over  the  top  of  the 
fairlead,  striking  the  officer  on  his  right  arm  and  throwing  him  against  the  accommodation 
bulkhead.  Neither  the  officer  nor  the  crew  member  helping  him  noticed  that  the  mooring  rope 
had  been  passed  inadvertently  around  the  fairlead.  This  was  an  error  resulting  from  lack  of 
attention.  The  investigation  determined  that  the  design  of  the  aft  mooring  arrangement 
increased  the  likelihood  that  such  an  error  would  be  made.  The  investigation  also  determined 
that,  due  to  the  ship’s  work  schedules,  it  was  likely  that  the  officer  and  crew  member  had 
endured  days  of  fragmented  sleep  and  were  suffering  from  chronic  fatigue,  a  state  that 
increases  the  probability  of  attentional  deficits.  So  in  this  case,  both  a  ship  design  flaw  and  a 
problem  with  the  ship’s  work  schedules  appeared  to  contribute  to  the  attentional  errors  that 
caused  the  death  of  the  officer. 

4.1.3  Perceptual  Errors 

Not  unexpectedly,  when  one’s  perception  of  the  world  differs  from  reality,  errors  can,  and  often 
do,  occur.  Typically,  perceptual  errors  occur  when  sensory  input  is  degraded,  such  as 
navigating  at  night.  Visual  illusions,  for  example,  occur  when  the  brain  tries  to  “fill  in  the  gaps” 
and  make  sense  out  of  sparse  information.  In  the  earlier  example  of  the  CGC  CUYAHOGA,  the 
captain  made  a  perceptual  error  in  his  interpretation  of  the  configuration  of  the  running  lights  on 
the  SANTA  CRUZ  II.  Flad  he  seen  the  vessel  in  daylight,  there  would  have  been  many  visual 
cues  available  to  determine  the  type  and  heading  of  the  vessel;  but  at  night,  with  little  visual 
information  available,  it  is  all  too  easy  to  misinterpret. 

Another  common  type  of  perceptual  error  occurs  when  trying  to  communicate  in  a  noisy 
environment.  Static  over  the  radio  or  noise  from  engines  and  generators  can  muffle  or  degrade 
spoken  words  and  commands.  Again,  the  brain  will  attempt  to  “fill  in”  what  wasn’t  heard  -  often 
based  on  the  listener’s  expectations,  be  they  correct  or  incorrect.  As  an  example,  a  ship  was 
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transiting  restricted  waters  when  the  Third  Engineer  noticed  that  the  lube  oil  pressure  was  low. 
He  shouted  (across  a  noisy  engine  room)  to  a  cadet  to  adjust  the  pressure.  The  cadet 
misunderstood  (perception  error)  and  closed  the  valve,  causing  the  engine  to  go  to  dead  slow 
and  creating  a  dangerous  situation  by  greatly  reducing  the  ship’s  maneuverability  in  the  high- 
traffic  waterway  (McCallum,  Raby,  Rothblum,  Forsythe,  Slavish,  &  Smith,  2000,  unpublished). 

4.1.4  Routine  Violations 

As  discussed  above,  errors  occur  when  someone  is  trying  to  follow  the  rules  and  do  the  right 
thing,  but  gets  an  unexpected  result.  By  contrast,  a  violation  is  when  someone  intentionally 
ignores  or  “bends”  a  rule.  Routine  violations  tend  to  be  habitual  by  nature  and  are  often 
tolerated  by  supervision  (in  the  case  of  not  following  a  standard  operating  procedure)  or  by  the 
governing  authority  (in  the  case  of  not  following  a  regulation)  (Reason,  1990).  Consider,  for 
example,  the  individual  who  routinely  drives  5-10  mph  faster  than  the  posted  speed  limit  (a 
routine  violation).  Since  the  police  will  rarely  pull  someone  over  for  such  a  minor  infraction,  they 
are  tolerating  the  violation  and  implicitly  reinforcing  the  unsafe  behavior.  If  the  police  were  to 
crack  down  on  minor  speeding,  people  would  be  less  likely  to  violate  the  speed  limit.  Therefore, 
if  a  routine  violation  is  identified  during  an  incident  investigation,  the  investigator  must  look 
further  up  the  supervisory  chain  to  identify  those  individuals  in  authority  who  are  not  enforcing 
the  rules. 

4.1.5  Exceptional  Violations 

Unlike  routine  violations,  exceptional  violations  appear  as  isolated  departures  from  authority, 
not  necessarily  indicative  of  the  individual’s  typical  behavior  pattern  nor  condoned  by 
management  (Reason,  1990).  For  example,  an  isolated  instance  of  driving  105  mph  in  a  55 
mph  zone  is  considered  an  exceptional  violation.  Note  that  the  violation  is  not  considered 
“exceptional”  because  of  its  extreme  nature.  Rather,  it  is  considered  exceptional  because  it  is 
neither  typical  of  the  individual  nor  condoned  by  authority.  The  fact  that  such  behavior  is  not 
typical  of  the  individual  makes  it  difficult  to  predict  and  deal  with  exceptional  violations. 

4.2  HFACS:  Preconditions  for  Unsafe  Acts 

Although  unsafe  acts  can  be  linked  to  the  vast  majority  of  incidents,  simply  focusing  on  unsafe 
acts  is  like  focusing  on  a  fever  without  understanding  the  underlying  disease  causing  it.  Thus, 
investigators  must  dig  deeper  into  why  the  unsafe  acts  took  place.  As  a  first  step,  it  is  useful  to 
consider  any  preconditions  for  unsafe  acts.  There  are  two  major  subdivisions  of  unsafe 
conditions  (preconditions):  substandard  conditions  of  the  operators  and  the  substandard 
practices  they  commit  (Fig.  11).  Substandard  conditions  are  broken  down  into  Adverse  Mental 
States,  Adverse  Physiological  States,  and  Physical/Mental  Limitations.  Types  of  Substandard 
Practices  include  Crew  Resource  Mismanagement  and  Personal  Readiness.  Each  of  these 
subcategories  is  discussed  below. 
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Figure  1 1 .  Classification  of  Preconditions  for  Unsafe  Acts 

(modified  from  Shappell  &  Wiegmann,  2000,  and  TSB,  1998) 

4.2.1  Adverse  Mental  States  (Substandard  Conditions  of  Operators) 

Being  prepared  mentally  is  critical  in  nearly  every  endeavor.  As  such,  the  category  of  Adverse 
Mental  States  was  created  to  account  for  those  mental  conditions  that  affect  performance.  Key 
examples  in  the  maritime  and  off-shore  industries  are  loss  of  situational  awareness, 
overconfidence,  and  complacency.  Predictably,  if  an  individual  loses  situational  awareness,  the 
likelihood  increases  that  an  error  will  occur.  In  a  similar  fashion,  pernicious  attitudes  such  as 
overconfidence  and  complacency  increase  the  likelihood  that  a  violation  will  be  committed. 
Clearly  then,  any  framework  of  human  error  must  account  for  pre-existing  adverse  mental  states 
in  the  causal  chain  of  events. 
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4.2.2  Adverse  Physiological  States  (Substandard  Conditions  of  Operators) 

This  category  refers  to  those  medical  or  physiological  conditions  that  preclude  safe  operations. 
For  example,  illness  can  have  a  negative  impact  on  our  performance.  Nearly  all  of  us  have 
gone  to  work  ill,  dosed  with  over-the-counter  medications,  and  have  generally  performed 
sufficiently  well.  However,  the  side-effects  of  antihistamines,  and  the  fatigue  and  sleep  loss  that 
often  accompany  an  illness  can  be  detrimental  to  decision-making.  For  example,  over-the- 
counter  antihistamines  decrease  vigilance,  performance  on  divided  attention  tasks,  and  short¬ 
term  memory,  resulting  in  a  14%  loss  of  productivity  and  an  increase  in  errors  (Kay,  2000). 
Sleep  loss,  even  in  healthy  individuals,  increases  the  risk  of  accidents.  Every  April  when  the 
U.S.  “springs  ahead”  to  daylight  savings  time,  there  is  a  significant  increase  in  automobile 
accidents:  and  this  is  from  a  mere  one  hour  decrease  in  sleep  time  (Coren,  1998;  Monk,  1980). 
Therefore,  it  is  incumbent  upon  any  safety  professional  to  account  for  these  sometimes  subtle 
medical  and  physiological  conditions  within  the  causal  chain  of  events. 

4.2.3  Phvsical/Mental  Limitations  (Substandard  Conditions  of  Operators) 

The  final  substandard  condition  involves  individual  physical  and  mental  limitations.  Specifically, 
this  category  refers  to  those  instances  when  task  or  situational  requirements  exceed  the 
capabilities  of  the  operator.  For  example,  the  human  visual  system  is  severely  limited  at  night. 
Yet,  most  people  do  not  take  this  into  account  when  driving  a  car  at  night,  and  do  not  slow  down 
or  take  other  precautions.  Similarly,  there  are  occasions  when  the  time  required  to  complete  a 
task  exceeds  an  individual’s  capacity.  Individuals  vary  widely  in  their  abilities  to  process  and 
respond  to  information.  It  is  well  documented  that  if  individuals  are  required  to  respond  quickly 
(i.e.,  less  time  is  available  to  consider  all  the  options  thoroughly),  the  probability  of  making  an 
error  goes  up  markedly.  Consequently,  it  should  be  no  surprise  that  when  faced  with  the  need 
for  rapid  processing  and  reaction  times,  as  is  the  case  in  emergencies,  all  forms  of  errors  would 
be  exacerbated. 

In  addition  to  the  basic  sensory  and  information  processing  limitations  described  above,  there 
are  at  least  two  additional  instances  of  physical  and  mental  limitations  that  need  to  be 
addressed,  albeit  they  are  often  overlooked  by  most  safety  professionals.  These  limitations 
involve  individuals  who  simply  are  not  compatible  with  a  given  job,  because  they  are  either 
unsuited  physically  or  they  do  not  possess  the  aptitude  to  do  it.  For  example,  some  individuals 
simply  do  not  have  the  physical  strength  required  to  operate  manual  valves  or  haul  heavy 
equipment.  Likewise,  not  everyone  has  the  mental  ability  or  aptitude  for  every  job.  The  difficult 
task  for  the  safety  professional  is  identifying  whether  physical  or  mental  aptitude  might  have 
contributed  to  the  incident  causal  sequence. 

Clearly  then,  numerous  substandard  conditions  of  operators  can,  and  do,  lead  to  the 
commission  of  unsafe  acts.  Nevertheless,  there  are  a  number  of  things  that  we  do  to  ourselves 
that  set  up  these  substandard  conditions.  Generally  speaking,  the  substandard  practices  of 
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operators  can  be  summed  up  in  two  categories:  crew  resource  mismanagement  and  personal 
readiness. 

4.2.4  Crew  Resource  Mismanagement  (Substandard  Practices  of  Operators) 

Operations  in  the  off-shore  and  maritime  industries  depend  on  good  communications  and 
teamwork.  Communication  and  coordination  is  essential,  not  just  between  workers  on  a  given 
task,  but  between  teams  working  on  complementary  or  coordinated  tasks.  On  a  ship, 
communications  may  be  important  between  members  of  the  same  department  (e.g.,  two 
engineers  repairing  a  piece  of  equipment,  or  passing  information  during  a  watch  relief),  between 
departments  (the  deck  officer  may  need  to  notify  engineering  of  an  upcoming  maneuver), 
between  ships  (for  meeting  and  passing  arrangements),  and  between  the  ship  and  other  groups 
or  authorities  such  as  Vessel  Traffic  Service,  bridge  tenders,  dock  workers,  and  the  vessel 
agent.  The  need  for  communication  and  coordination  is  often  overlooked,  leading  to  incidents. 
One  study  of  maritime  casualties  found  that  a  lack  of  communication  contributed  to  18%  of 
vessel  casualties  and  28%  of  personnel  injuries  (McCallum,  Raby,  Rothblum,  Forsythe,  Slavish, 
&  Smith,  2000). 

Here’s  an  example  of  how  such  crew  resource  mismanagement  can  result  in  a  serious  incident. 
A  barge  was  moored  to  a  quarry  loading  facility  by  a  pull  cable  that  was  controlled  from  the 
facility.  The  deckhand  on  the  barge  noticed  that  the  pull  cable  was  caught  under  a  deck  fitting, 
and  walked  over  to  free  it.  Before  he  reached  it,  a  dock  worker  started  the  winch  to  take  the 
slack  out  of  the  mooring  line.  As  the  cable  tightened,  it  snapped  off  the  fitting  and  struck  the 
deckhand  with  such  force  that  he  required  surgery.  In  this  case,  both  the  deckhand  and  the 
dock  worker  should  have  -  but  didn’t  -  alert  the  other  to  their  plans:  an  obvious  failure  of  crew 
coordination.  A  serious  injury  was  the  unhappy  consequence  of  this  lack  of  crew  resource 
management  (Rothblum,  2000). 

4.2.5  Personal  Readiness  (Substandard  Practices  of  Operators) 

In  every  occupation,  people  are  expected  to  show  up  for  work  ready  to  perform  at  optimal  levels. 
Nevertheless,  personal  readiness  failures  occur  when  individuals  fail  to  prepare  physically, 
mentally,  or  physiologically  for  duty.  For  instance,  violations  of  work-rest  rules,  use  of 
intoxicants  and  certain  medications,  and  participating  in  exhausting  domestic  or  recreational 
activities  prior  to  reporting  for  duty  can  impair  performance  on  the  job  and  can  be  preconditions 
for  unsafe  acts.  While  some  of  these  maladaptive  behaviors  may  be  addressed  by  rules  and 
regulations,  most  are  left  up  to  the  judgement  of  the  individual.  It  is  necessary  for  the  individual 
to  understand  that  some  “off-time”  activities  can  be  detrimental  to  subsequent  job  performance. 
The  incident  investigator  needs  to  probe  for  personal  readiness  and  activities  that  may  have 
degraded  it. 
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4.3  HFACS:  Unsafe  Supervision 

In  addition  to  investigating  those  causal  factors  associated  directly  with  the  operator,  it  is 
necessary  to  trace  the  possible  causal  chain  of  events  up  the  supervisory  chain  of  command 
(Reason,  1990).  It  has  been  estimated  that  80%  of  offshore  platform  accidents  have  their 
predominant  roots  in  supervisory  and  organizational  factors  (Bea,  Holdsworth,  &  Smith,  1997). 
There  are  four  categories  of  unsafe  supervision:  inadequate  supervision,  planned  inappropriate 
operations,  failure  to  correct  a  known  problem,  and  supervisory  violations  (Fig.  12).  Each  is 
described  briefly  below. 

4.3.1  Inadequate  Supervision 

The  role  of  any  supervisor  is  to  provide  the  opportunity  to  succeed.  To  do  this,  the  supervisor, 
no  matter  at  what  level  of  operations,  must  provide  guidance,  training  opportunities,  leadership, 
and  motivation,  as  well  as  the  proper  role  model  to  be  emulated.  Unfortunately,  this  is  not 
always  the  case.  For  example,  it  is  not  difficult  to  conceive  of  a  situation  where  adequate  crew 
resource  management  training  was  either  not  provided,  or  the  opportunity  to  attend  such 
training  was  not  afforded  to  a  particular  crew  member.  Conceivably,  coordinated  teamwork 
would  be  compromised,  and  if  an  emergency  situation  arose,  the  risk  of  an  error  being 
committed  would  be  exacerbated  and  the  potential  for  an  incident  would  increase  markedly. 

In  a  similar  vein,  sound  professional  guidance  and  oversight  is  an  essential  ingredient  of  any 
successful  organization.  While  empowering  individuals  to  make  decisions  and  function 
independently  is  certainly  essential,  this  does  not  divorce  the  supervisor  from  accountability. 
The  lack  of  guidance  and  oversight  has  proven  to  be  the  breeding  ground  for  many  of  the 
violations  that  have  crept  into  the  cockpit.  As  such,  any  thorough  investigation  of  incident 
causal  factors  must  consider  the  role  supervision  plays  (i.e.,  whether  the  supervision  was 
inappropriate  or  did  not  occur  at  all)  in  the  genesis  of  human  error. 

4.3.2  Planned  Inappropriate  Operations 

Occasionally,  the  operational  tempo  and/or  the  scheduling  of  personnel  is  such  that  individuals 
are  put  at  unacceptable  risk,  crew  rest  is  jeopardized,  and  ultimately  performance  is  adversely 
affected.  Such  operations,  though  arguably  unavoidable  during  emergencies,  are  unacceptable 
during  normal  operations.  Therefore,  the  second  category  of  unsafe  supervision,  planned 
inappropriate  operations,  was  created  to  account  for  these  failures. 
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Figure  12.  Categories  of  Unsafe  Supervision. 

(modified  from  Shappell  &  Wiegmann,  2000) 


Take,  for  example,  the  issue  of  improper  team  complements.  In  aviation  it  is  well  known  that 
when  very  senior,  dictatorial  captains  are  paired  with  very  junior,  weak  co-pilots,  communication 
and  coordination  problems  are  likely  to  occur.  This  type  of  personality  mismatch  is  apt  to 
happen  in  any  team  environment,  and  can  (and  do)  contribute  to  tragic  accidents  (such  as  the 
crash  of  a  commercial  airliner  into  the  Potomac  River  shortly  after  takeoff  in  1982).  When  team 
member  selection  is  not  taken  into  account,  gross  perceived  differences  in  authority  and 
experience  can  cause  more  junior  team  members  to  be  ignored,  effectively  eliminating  an 
important  input  to  the  team  as  a  whole. 
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4.3.3  Failure  to  Correct  a  Known  Problem 

The  third  category  of  known  unsafe  supervision,  Failed  to  Correct  a  Known  Problem,  refers  to 
those  instances  when  deficiencies  among  individuals,  equipment,  training  or  other  related 
safety  areas  are  “known”  to  the  supervisor,  yet  are  allowed  to  continue  unabated.  For  example, 
a  given  worker  might  have  a  reputation  for  risky  behavior  or  cutting  safety  margins  too  closely. 
If  the  supervisor  knows  this  and  allows  the  behavior  to  continue,  an  incident  may  be  the 
unsurprising  consequence.  The  failure  to  correct  the  behavior,  either  through  remedial  training 
or,  if  necessary,  removal  from  the  job,  can  put  the  entire  operation  at  risk.  Likewise,  the  failure 
to  consistently  correct  or  discipline  inappropriate  behavior  fosters  an  unsafe  atmosphere  and 
promotes  the  violation  of  rules. 

4.3.4  Supervisory  Violations 

Supervisory  violations,  on  the  other  hand,  are  reserved  for  those  instances  when  existing  rules 
and  regulations  are  willfully  disregarded  by  supervisors.  Although  relatively  rare,  supervisors 
have  been  known  occasionally  to  violate  the  rules  and  doctrine  when  managing  their  assets. 
For  instance,  sometimes  individuals  are  assigned  to  do  a  task  for  which  they  are  unqualified, 
either  through  the  lack  of  sufficient  training,  or  even  lacking  the  appropriate  license.  The  failure 
to  enforce  existing  rules  and  regulations  or  flaunting  authority  are  also  violations  at  the 
supervisory  level.  While  rare  and  possibly  difficult  to  identify,  such  practices  are  a  flagrant 
violation  of  the  rules  and  invariably  set  the  stage  for  the  tragic  sequence  of  events  that 
predictably  follow. 

4.4  HFACS:  Organizational  Influences 

As  noted  previously,  fallible  decisions  of  upper-level  management  directly  affect  supervisory 
practices,  as  well  as  the  conditions  and  actions  of  operators.  Unfortunately,  these 
organizational  errors  often  go  unnoticed  by  safety  professionals,  due  in  large  part  to  the  lack  of 
a  clear  framework  from  which  to  investigate  them.  Generally  speaking,  the  most  elusive  of 
latent  failures  revolve  around  issues  related  to  resource  management,  organizational  climate, 
and  operational  processes,  as  detailed  in  Figure  13. 
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Figure  13.  Organizational  Factors  Which  Contribute  to  Incidents 

(modified  from  Shappell  &  Wiegmann,  2000) 


4.4.1  Resource  Management 

This  category  encompasses  the  realm  of  corporate-level  decision  making  regarding  the 
allocation  and  maintenance  of  organizational  assets  such  as  human  resources  (personnel), 
monetary  assets,  and  equipment  and  facilities.  Generally,  corporate  decisions  about  how  such 
resources  should  be  managed  center  around  two  distinct  objectives  -  the  goal  of  safety  and  the 
goal  of  on-time,  cost-effective  operation.  In  times  of  prosperity,  both  objectives  can  be  easily 
balanced  and  satisfied  in  full.  However,  there  may  also  be  times  of  fiscal  austerity  that  demand 
some  give  and  take  between  the  two.  Unfortunately,  accident  reports  show  us  time  and  again 
that  safety  is  often  the  loser  in  such  battles  and,  as  some  can  attest  to  very  well,  safety  and 
training  are  often  the  first  to  be  cut  in  organizations  having  financial  difficulties.  If  cutbacks  in 
such  areas  are  too  severe,  worker  proficiency  may  suffer,  leading  to  errors  and  incidents. 
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Excessive  cost-cutting  could  also  result  in  reduced  funding  for  new  equipment  or  may  lead  to 
the  purchase  of  equipment  that  is  sub-optimal  and  inadequately  designed  for  the  task.  Other 
trickle-down  effects  include  poorly  maintained  equipment  and  workspaces,  and  the  failure  to 
correct  known  design  flaws  in  existing  equipment.  The  result  is  a  scenario  involving 
unseasoned,  less-skilled  workers  using  poorly  maintained  equipment  under  less  than  desirable 
conditions  and  schedules.  The  ramifications  for  safety  are  not  hard  to  imagine. 

4.4.2  Organizational  Climate 

Climate  refers  to  a  broad  class  of  organizational  variables  that  influence  worker  performance. 
In  general,  organizational  climate  can  be  viewed  as  the  working  atmosphere  within  the 
organization.  One  telltale  sign  of  an  organization’s  climate  is  its  structure,  as  reflected  in  the 
chain-of-command,  delegation  of  authority  and  responsibility,  communication  channels,  and 
formal  accountability  for  actions.  Just  like  in  the  operational  arena,  communication  and 
coordination  are  vital  within  an  organization.  If  management  and  staff  within  an  organization  are 
not  communicating,  or  if  no  one  knows  who  is  in  charge,  organizational  safety  clearly  suffers 
and  incidents  do  happen  (Muchinsky,  1997). 

An  organization’s  policies  and  culture  are  also  good  indicators  of  its  climate.  Policies  are 
official  guidelines  that  direct  management’s  decisions  about  such  things  as  hiring  and  firing, 
promotion,  retention,  raises,  sick  leave,  drugs  and  alcohol,  overtime,  incident  investigations, 
and  the  use  of  safety  equipment.  Culture,  on  the  other  hand,  refers  to  the  unofficial  or 
unspoken  rules,  values,  attitudes,  beliefs,  and  customs  of  an  organization.  Culture  is  “the  way 
things  rea//y  get  done  around  here.” 

When  policies  are  ill-defined,  adversarial,  or  conflicting,  or  when  they  are  supplanted  by 
unofficial  rules  and  values,  confusion  abounds  within  the  organization.  Indeed,  there  are  some 
corporate  managers  who  are  quick  to  give  “lip  service”  to  official  safety  policies  while  in  a  public 
forum,  but  then  overlook  such  policies  when  operating  behind  the  scenes.  Safety  is  bound  to 
suffer  under  such  conditions. 

4.4.3  Organizational  Process 

This  category  refers  to  corporate  decisions  and  rules  that  govern  the  everyday  activities  within 
an  organization,  including  the  establishment  and  use  of  standardized  operating  procedures  and 
formal  methods  for  maintaining  checks  and  balances  (oversight)  between  the  workforce  and 
management.  For  example,  such  factors  as  operational  tempo,  time  pressures,  incentive 
systems,  and  work  schedules  are  all  factors  that  can  adversely  affect  safety  (Fig.  13).  There 
may  be  instances  when  those  within  the  upper  echelon  of  an  organization  determine  that  it  is 
necessary  to  increase  the  operational  tempo  to  a  point  that  overextends  a  supervisor’s  staffing 
capabilities.  Therefore,  a  supervisor  may  resort  to  the  use  of  inadequate  scheduling 
procedures  that  jeopardize  crew  rest  and  produce  sub-optimal  crew  complements,  putting  the 
operation  and  its  workers  at  an  increased  risk  of  a  mishap.  Organizations  should  have  official 
procedures  in  place  to  address  such  contingencies  as  well  as  oversight  programs  to  monitor 
such  risks. 
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Regrettably,  not  all  organizations  have  these  procedures  nor  do  they  engage  in  an  active 
process  of  monitoring  operator  errors  and  human  factors  problems  via  anonymous  reporting 
systems  and  safety  audits.  As  such,  supervisors  and  managers  are  often  unaware  of  the 
problems  before  an  incident  occurs.  It  is  incumbent  upon  any  organization  to  fervently  seek  out 
the  “holes  in  the  cheese”  and  plug  them  up,  before  they  create  a  window  of  opportunity  for 
catastrophe  to  strike. 

4.5  The  Benefits  of  Using  HFACS 

The  Human  Factors  Analysis  and  Classification  System  (HFACS)  framework  bridges  the  gap 
between  theory  and  practice  by  providing  investigators  with  a  comprehensive,  user-friendly  tool 
for  identifying  and  classifying  the  human  causes  of  incidents.  The  system,  which  is  based  upon 
Reason’s  (1990)  model  of  latent  and  active  failures  (Shappell  &  Wiegmann,  1997a), 
encompasses  all  aspects  of  human  error,  including  the  conditions  of  operators  and 
organizational  failure.  Still,  HFACS  and  any  other  framework  only  contribute  to  an  already 
burgeoning  list  of  human  error  taxonomies  (see,  for  example.  Appendix  C)  if  it  does  not  prove 
useful  in  the  operational  setting.  In  this  regard,  HACS  has  recently  been  employed  by  the  U.S. 
Navy,  Marine  Corps,  Army,  Air  Force,  and  Coast  Guard  for  use  in  aviation  accident  investigation 
and  analysis.  To  date,  HFACS  has  been  applied  to  the  analysis  of  human  factors  data  from 
approximately  1,000  military  aviation  accidents.  Throughout  this  process,  the  reliability  and 
content  validity  of  HFACS  has  been  repeatedly  tested  and  demonstrated  (Shappell  & 
Wiegmann,  1997b).  HFACS  has  also  been  implemented  by  other  types  of  organizations;  an 
example  of  its  use  by  the  Marine  Facilities  Division  of  the  California  State  Lands  Commission  in 
the  investigation  of  incidents  at  marine  terminals  is  provided  in  Section  8  and  Appendix  E. 

Given  that  accident/incident  databases  can  be  reliably  analyzed  using  HFACS,  the  next  logical 
question  is  whether  anything  unique  will  be  identified.  Early  indications  within  the  military 
suggest  that  the  HFACS  framework  has  been  instrumental  in  the  identification  and  analysis  of 
global  human  factors  safety  issues,  such  as  trends  in  operator  proficiency,  causes  of  specific 
accident  types,  and  problems  such  as  failures  of  crew  resource  management  (Shappell  & 
Wiegmann,  2000).  Consequently,  the  systematic  application  of  HFACS  to  the  analysis  of 
human  factors  accident  data  has  afforded  the  U.S.  Navy  and  Marine  Corps  (for  which  the 
original  classification  system  was  developed)  the  ability  to  develop  objective,  data-driven 
intervention  strategies. 

Additionally,  the  HFACS  framework  and  the  insights  gleaned  from  database  analyses  have 
been  used  to  develop  innovative  incident  investigation  methods  that  have  enhanced  both  the 
quantity  and  quality  of  the  human  factors  information  gathered  during  incident  investigations. 
However,  not  only  are  safety  professionals  better  suited  to  examine  human  error  in  the  field,  but 
using  HFACS,  they  can  now  track  those  areas  (the  “holes  in  the  cheese”)  responsible  for  the 
incidents  as  well.  Only  now  is  it  possible  to  track  the  success  or  failure  of  specific  intervention 
programs  designed  to  reduce  specific  types  of  human  error  and  subsequent  incidents.  In  so 
doing,  research  investments  and  safety  programs  can  be  either  readjusted  or  reinforced  to  meet 
the  changing  needs  of  safety. 
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5.0  Putting  It  All  Together:  Investigating  an  Incident  for  Human  Factors 
Causes 

5.1  Introduction 

As  stated  earlier,  in  an  incident  investigation,  the  investigator  starts  with  the  immediate  actions 
and  events  surrounding  the  incident  and  then  works  backwards  to  uncover  contributing  causes. 
Who,  where,  when,  what,  and  how  are  all  useful  questions  to  get  information  relevant  to  the 
incident;  but  asking  why  is  what  will  help  the  investigator  “drill  down”  into  the  contributing,  latent 
conditions  that  need  to  be  identified  and  resolved  in  order  to  avoid  similar  incidents  in  the 
future.  Remember  from  our  introductory  discussion  that  it’s  not  just  the  people  you  want  to 
concentrate  on,  but  also  the  ways  in  which  technology,  environment,  and  organizational  factors 
influenced  human  performance. 

5.2  Incident  Investigation:  Going  Beyond  the  Obvious 

If  we  are  to  learn  from  an  incident,  it  is  very  important  to  go  beyond  the  “obvious”  cause  and 
ferret  out  the  underlying,  contributing  causes.  Here’s  an  example.  During  the  early  hours  of  a 
November  morning,  the  DOLE  AMERICA,  a  Liberian-registered  refrigerated  cargo  vessel, 
collided  with  the  Nab  Tower,  a  conspicuously-lit,  man-made  construction  in  the  eastern 
approaches  to  The  Solent  off  the  Isle  of  Wight  (MAIB,  1999).  The  ship  had  left  her  berth  in 
Portsmouth  and  was  proceeding  seaward  with  the  Norwegian  captain,  a  Filipino  officer,  and  a 
helmsman  on  the  bridge.  The  captain  was  in  charge,  and  he  set  a  course  to  pass  to  the  east  of 
the  tower.  Suddenly,  he  saw  on  the  starboard  bow  what  he  thought  was  the  red  portside  light  of 
a  vessel  at  close  range,  crossing  from  starboard  to  port  and  presenting  an  imminent  risk  of 
collision.  The  captain  ordered  starboard  helm  before  going  to  the  front  of  the  bridge  to  confirm 
what  he  thought  he  had  seen.  He  then  called  the  officer  to  join  him,  and  the  officer  confirmed 
the  presence  of  a  red  light  and  reported  a  second  red  light  to  starboard  of  the  first.  The  captain 
then  ordered  hard  to  starboard  helm.  When  no  further  lights  were  seen  ahead,  the  captain 
ordered  hard  to  port  helm,  still  with  the  intention  of  passing  to  the  east  of  the  Nab  Tower.  The 
ship  struck  the  tower  shortly  afterwards. 

The  immediate  cause  of  the  collision  was  the  master’s  inappropriate  and  unquestioned  helm 
order  to  port  (unsafe  act  -  decision  error).  However,  the  following  contributing  factors  were 
important  to  this  casualty: 

•  From  his  position  at  the  front  of  the  bridge,  the  captain  was  unaware  of  the  ship’s 
heading  and  her  exact  position  in  relation  to  the  tower  (precondition  for  unsafe  act  - 
substandard  practice  -  crew  resource  mismanagement). 

•  No  discussions  took  place  between  the  captain  and  the  officer  concerning  the  ship’s 
progress  (precondition  for  unsafe  act  -  substandard  practice  -  crew  resource 
mismanagement). 
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•  The  captain  and  the  officer  failed  to  work  as  an  effective  team,  probably  due,  in  part, 
to  their  differing  nationality  and  social  backgrounds,  and  to  an  autocratic 
management  style  (precondition  for  unsafe  act  -  substandard  practice  -  crew 
resource  mismanagement  and  organizational  factor  -  organizational  climate). 

•  With  no  dedicated  lookout  to  refer  to,  the  captain  called  the  officer  to  join  him  at  the 
front  of  the  bridge,  thereby  removing  his  only  source  of  navigational  information 
(unsafe  act  -  decision  error). 

•  The  ship’s  manager  provided  no  specific  instructions  to  its  officers  regarding 
voluntarily  offering  relevant  information  to  the  captain  (organizational  factor  - 
organizational  climate). 

While  the  immediate  cause  was  the  captain’s  poor  decision  making  due  to  inadequate 
information,  future  avoidance  of  this  type  of  incident  depends  on  correcting  the  underlying 
unsafe  conditions  and  organizational  factors.  Changing  the  autocratic  management  style  that 
was  in  place  in  this  company  to  one  of  crew  resource  management,  and  training  the  bridge 
team  to  operate  more  effectively  by  empowering  the  officer  to  actively  contribute  to  navigational 
decisions  (particularly  relevant  to  a  multi-national  crew)  are  keys  to  preventing  such  a  casualty. 
Had  the  investigation  stopped  with  the  “obvious”  cause,  the  true  precursors  to  this  incident 
would  have  remained  hidden,  and  remedial  actions  based  only  on  the  immediate  cause  would 
have  been  ineffective. 

5.3  A  Tool  for  Investigation:  Events  and  Causal  Factors  Charting 

Before  one  can  begin  identifying  the  human  error  causes  of  an  incident,  one  needs  a  way  to 
represent  how  an  incident  happened.  There  are  a  number  of  tools  that  can  be  used  to  get 
varying  levels  of  detail  surrounding  the  events  of  an  incident  and  what  might  have  contributed  to 
it.  Some  of  these  include  timeline  analysis,  link  analysis,  barrier  analysis,  work  safety  analysis, 
human  error  HAZOP,  and  human  error  analysis.  Most  of  these  can  be  used  either  during  a 
safety  audit  (to  understand  the  work  conditions  and  identify  risks  before  an  incident  occurs)  or 
during  an  incident  investigation.  A  good  introduction  to  these  methods  may  be  found  in  Kirwan 
(1997). 

Another  method  that  is  more  directly  related  to  understanding  the  progression  and  causes  of  an 
incident  is  Events  and  Causal  Factors  Charting  (Hill  &  Byers,  1992a).  This  method  was 
originally  developed  by  the  National  Transportation  Safety  Board  for  the  analysis  of  accident 
investigations.  It  highlights  the  major  events  in  the  progression  of  an  incident  and  also 
associates  contributing  causes  to  each  event.  “Contributing  causes”  include  not  only  active  and 
latent  human  errors,  but  also  equipment  problems,  weather,  and  anything  else  which  may  have 
influenced  the  events  surrounding  the  incident.  Events  and  causal  factor  charting  can  be 
helpful  in  organizing  and  understanding  the  sequence  of  events  and  also  in  identifying  holes  or 
inconsistencies  in  the  incident  information  collected. 
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To  illustrate  how  Events  and  Causal  Factors  Charting  can  be  used,  let’s  take  a  closer  look  at 
the  TORREY  CANYON  incident  that  was  introduced  in  Section  2  (Hill  &  Byers,  1992b). 

5.3.1  TORREY  CANYON  Synopsis 

The  Captain  of  the  TORREY  CANYON  was  experienced,  careful,  and  a  stickler  for  details.  The 
TORREY  CANYON  was  traveling  from  Kuwait  to  Wales  with  a  cargo  of  100,000  tons  of  oil. 
They  were  heading  for  Angle  Bay,  British  Petroleum’s  (BP)  deep-water  terminal  on  the  western 
tip  of  Wales.  The  day  before  the  TORREY  CANYON  was  due  to  arrive  at  Angle  Bay,  the 
captain  was  contacted  by  BP’s  agent,  who  told  him  of  impending  decreases  in  the  tide  at  Milford 
Haven,  at  the  entrance  to  Angle  Bay.  He  was  told  that  if  the  TORREY  CANYON  did  not  catch 
high  tide  on  the  next  evening,  it  would  have  to  wait  outside  the  harbor  for  most  of  a  week  for  the 
next  tide  high  enough  to  get  the  ship  in.  Now,  to  have  a  ship  of  that  size  sitting  idle  for  five  days 
is  very  expensive,  and  the  captain  was  determined  to  reach  Milford  Haven  on  time.  This  didn’t 
seem  to  present  any  problem  at  the  time;  to  be  ready  to  catch  the  high  tide  the  next  evening  the 
TORREY  CANYON  had  to  get  to  Milford  Haven  and  it  had  to  transfer  cargo  from  the  midship 
tanks  to  the  fore  and  aft  tanks  to  even  out  the  ship’s  draft.  At  sea,  the  tanker  drew  52  feet  4 
inches  amidships,  but  that  was  too  deep  to  make  it  into  Angle  Bay,  so  they  had  to  shift  cargo. 
The  captain  estimated  the  transfer  would  take  about  four  hours  and  planned  to  make  the 
transfer  after  they  reached  Milford  Haven.  Still,  there  seemed  to  be  plenty  of  time. 

The  next  morning,  the  captain  asked  to  be  called  when  the  Scilly  Islands  were  sighted.  The 
Scillies  are  made  up  of  48  tiny  islands  and  contains  a  number  of  submerged  large  rocks  and 
sandbars.  There  were  257  shipwrecks  there  between  1679  and  1933.  The  captain  was 
intending  to  sight  the  Scillies  to  starboard,  pass  them  to  the  west  and  then  go  into  Milford 
Haven.  However,  when  the  Scillies  were  sighted,  and  he  was  called,  they  were  off  the  port  bow. 
Rather  than  turn  and  go  west  around  the  islands,  the  captain  decided  he  needed  to  save  time 
and  would  pass  between  the  Scilly  Islands  and  Land’s  End,  the  southwesternmost  tip  of 
England.  The  passage  between  Land’s  End  and  the  Scillies  is  divided  into  two  parts  by  an 
island  and  each  of  those  parts  have  further  obstructions  within  them.  The  captain  decided  to 
take  the  western  channel.  He  did  not  have  a  copy  of  the  Channel  Pilot  for  the  region  and  he 
was  not  particularly  familiar  with  the  area.  The  TORREY  CANYON  was  making  full  speed  when 
it  met  some  fishing  boats  in  the  channel,  which  delayed  it  making  a  turn.  After  taking  a  bearing 
from  the  unfamiliar  landmarks,  the  captain  realized  that  he  had  overshot  his  turn  and  the 
channel.  When  he  ordered  hard  to  port,  and  the  helmsman  turned  the  wheel,  nothing 
happened.  The  captain  realized  that  the  steering  selector  switch  was  set  incorrectly  on 
autopilot,  reset  it  to  manual,  and  the  turn  to  port  was  begun.  The  TORREY  CANYON  then  ran 
into  a  granite  reef  so  hard  that  it  could  not  be  pulled  off.  The  Royal  Air  Force  eventually 
bombed  the  wreck  in  an  effort  to  burn  some  of  the  oil  before  it  washed  up  on  the  beaches. 


Working  Group  1  -  HFW2002 


Page  43  of  141 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


During  the  official  inquiry  which  followed,  it  was  pointed  out  that  the  captain  had  plenty  of  time  to 
get  to  Milford  Haven  if  he  had  transferred  his  cargo  while  underway®.  The  chairman  of  the 
board  of  inquiry  reportedly  stated  after  the  hearing,  “He  [the  captain]  didn’t  want  to  dirty  his 
deck,  to  come  into  port  looking  sloppy”  (Hill  &  Byers,  1992b).  Perrow  (1984,  p.  184)  points  out, 
that  as  most  accidents  do,  this  accident  involves  many  “if  only”  statements: 

•  If  only  the  captain  had  not  forgotten  to  put  the  helm  on  manual,  they  might  have  turned 
in  time; 

•  If  only  the  fishing  boats  had  not  been  out  that  day,  he  could  have  made  his  turn  earlier; 

•  If  only  he  had  prudently  slowed  down  once  he  saw  the  fishing  boats,  he  could  have 
turned  more  sharply; 

•  once  deciding  to  risk  going  through  the  Scilly  Islands  he  used  a  peculiar  passage 
through  them  -  if  only  he  had  used  another  passage,  it  might  have  been  safer  (even 
faster). 

We’ll  never  know  precisely  why  the  captain  made  the  decisions  he  made. 

5.3.2  An  Event  and  Causal  Factors  Chart  of  the  TORREY  CANYON  Incident 

To  do  an  Event  and  Causal  Factors  Chart,  we  begin  by  determining  the  major  events  that 
occurred.  Working  backwards  from  the  accident,  there  are  four  major  events: 

•  The  TORREY  CANYON  iaWs  to  make  its  turn  in  time  and  runs  aground; 

•  The  captain  takes  the  western  channel  between  the  Scilly  Islands  and  Land’s  End; 

•  The  TORREY  CANYON  goes  east  of  the  Scilly  Islands; 

•  The  Scilly  Islands  are  sighted  to  the  NW  (port)  rather  than  to  the  NE  (starboard). 

These  four  events  would  be  placed  in  boxes  (to  denote  that  they  are  “events”)  across  the  top  of 
the  page,  as  shown  below  in  Figure  14. 


This  accident  occurred  years  before  the  Exxon  Valdez  and  the  environmental  protection  legislation  that 
followed.  At  the  time  of  the  TORREY  CANYON  incident,  transferring  oil  while  underway  was  standard 
operating  procedure  for  many  companies. 
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Below  each  event  box,  we  list  the  perceived  causes  of  the  event,  depicted  as  ovals  (solid  ovals 
for  established  causes,  and  dotted  ovals  for  assumed  causes).  We  “drill  down”  into  the  causes 
by  asking  why.  For  example,  when  we  ask  why  the  TORREY  CANYON  taWed  to  make  the  turn 
in  time  (thereby  running  aground),  we  find  four  different  issues: 

•  The  TORREY  CANYON  taWed  to  begin  its  turn  in  time  because  there  were  fishing  boats 
in  the  way; 

•  The  captain  was  unfamiliar  with  the  waterway  and  landmarks,  making  him  late  to 
recognize  the  turning  point  and  initiate  the  turn; 

•  He  failed  to  slow  down  and  was  going  too  fast  to  make  the  turn; 
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•  The  steering  selector  switch  was  in  the  wrong  position  (autopilot),  and  by  the  time  it  was 
corrected,  it  was  too  late  to  make  the  turn. 

While  the  Events  and  Causal  Factors  Charting  often  ends  at  this  point,  we  want  to  take  it  a  step 
further  for  the  purpose  of  determining  active  and  latent  human  factors  causes.  To  do  this,  it  is 
helpful  to  remember  the  human-system  approach  discussed  in  Section  2  (refer  to  Fig.  2). 
Fluman  errors  result  not  only  from  errors  made  by  a  given  person,  but,  more  importantly,  human 
errors  usually  result  from  suboptimal  interactions  between  people  and  organizational, 
technological,  or  environmental  factors.  As  you  drill  down  seeking  contributing  causes,  keep 
asking  yourself  the  following  questions  to  help  you  identify  human  errors: 

•  Did  some  aspect  of  the  invoived  person  contribute  to  the  incident?  (consider 
knowledge,  skills,  experience,  motivation,  alertness,  physical  and  mental  states,  use  of 
medicines  or  drugs,  personal  problems,  etc.) 

•  Did  some  aspect  of  interpersonai  interactions  contribute  to  the  incident?  (consider 
communication,  definition  of  roles  and  responsibilities,  experience  working  as  a  team, 
autocratic  vs.  empowered  style,  etc.) 

•  Did  some  aspect  of  the  interactions  between  the  peopie  and  the  organization  contribute 
to  the  incident?  (consider  training  and  qualification  requirements,  crew/team 
complement,  work  schedules,  safety  culture,  supervision,  policies  regarding  economic 
pressure,  etc.) 

•  Did  some  aspect  of  the  interactions  between  the  peopie  and  the  technoiogy  contribute  to 
the  incident?  (consider  equipment  layout,  whether  equipment  is  designed  to  do  the  job, 
how  information  is  provided  from  the  equipment  to  the  user,  whether  controls  can  be 
easily  operated,  whether  displays  are  legible,  whether  the  design  obstructs  proper 
maintenance,  etc.) 

•  Did  some  aspect  of  the  interactions  between  the  peopie  and  the  environment  contribute 
to  the  incident?  (consider  the  workplace  environment  in  terms  of  lighting,  noise, 
temperature,  vibration,  ship  motion,  fog,  snow,  etc.;  also  consider  the  regulatory  and 
economic  environment  and  their  impact  on  job  behavior) 

The  human-system  approach  and  FIFACS  are  complementary  ways  of  looking  at  human  errors. 
In  the  human-system  approach,  we  identify  the  iocus  of  the  error.  That  is,  we  determine 
whether  the  error  resulted  because  of  a  deficiency  in  a  given  person’s  actions  or  decisions,  or 
whether  there  was  a  poor  interaction  between  multiple  people  or  between  people  and 
technology,  organization,  or  environment.  FIFACS  identifies  the  parts  of  the  company’s 
organization  that  had  the  responsibiiity  for  preventing  the  error.  That  is,  with  FIFACS  we 
determine  whether  the  individual  (Preconditions  for  an  Unsafe  Act),  the  line  supervisor  (Unsafe 
Supervision),  and-or  management  (Organizational  Influences)  had  the  responsibility  for 
preventing  the  error.  By  identifying  the  level(s)  of  the  organization  that  had  the  responsibility  for 
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preventing  an  incident,  we  identify  the  part(s)  of  the  organization  where  changes  must  be  made 
to  solve  the  human  error  problems. 

Now  let  us  look  again  at  the  Events  and  Causal  Factors  Chart  of  the  TORREY  CANYON 
grounding  and  use  the  human-system  approach  and  HFACS  to  identify  the  underlying  human 
factors  causes  of  the  last  event,  “Runs  aground.”  To  do  this,  we  would  continue  to  ask  why.  To 
ask  why  there  were  fishermen  in  the  way  doesn’t  get  us  anywhere  with  this  particular  case®. 
Note  that  the  presence  of  the  fishermen  is,  in  fact,  an  environmental  factor  that  interacts  with 
the  captain;  but  since  neither  the  captain  nor  the  company  have  any  control  over  the  presence 
of  fishermen,  that  aspect  of  the  incident  is  ignored.  The  captain  did  have  control  over  his 
response  to  the  presence  of  the  fishing  vessels,  and  that  will  be  discussed  in  the  third  causal 
factor. 

“Drilling  down”  on  the  second  causal  factor,  the  fact  that  the  captain  was  unfamiliar  with  the 
waterway,  is  more  enlightening.  The  captain  was  unfamiliar  with  the  route,  because  it  was  not 
the  route  he  had  planned  to  take.  Furthermore,  he  did  not  have  a  copy  of  the  Channel  Pilot  on 
board,  and  so  could  not  avail  himself  of  helpful  information.  Whyd\d  he  not  have  a  copy  of  the 
Channel  Pilot,  when  he  had  planned  to  take  a  nearby  route?  While  we  don’t  have  the  answer  to 
this  question,  it  might  have  involved  an  error  in  FIFACS  Organizational  Influences  - 
Organizational  Process  if  the  company  had  not  established  that  ships  carry  information  about  all 
routes  it  would  transit.  Or,  perhaps  the  company  had  the  policy,  but  the  captain  had  failed  to 
ensure  that  the  document  was  onboard  and  available  for  use;  this  would  be  an  example  of 
Unsafe  Supervision  -  Supervisory  Violation.  As  you  can  readily  see,  depending  on  who  was 
responsible  (the  company  or  the  captain),  the  type  of  corrective  action  needed  would  be  vastly 
different. 

Asking  why  the  captain  failed  to  slow  down  when  he  saw  the  fishing  vessels  (which  was 
determined  by  the  board  of  inquiry  to  be  the  prudent  action  to  have  taken),  the  probable  answer 
is  that  the  captain  felt  pressured  to  make  good  time,  and  that  pressure  negatively  influenced  his 
judgement.  While  there’s  no  question  that  the  captain’s  unsafe  act  (going  too  fast)  was  based 
on  a  decision  error,  we  need  to  continue  to  ask  why.  Why  did  the  captain  feel  such  a 
compulsion  to  make  good  time?  As  pointed  out  in  the  incident  synopsis,  had  the  captain 
missed  the  evening  high  tide  at  Milford  Flaven,  the  TORREY  CANYON  may  have  had  to  sit  idly 
waiting  for  several  days  before  the  next  tide  of  sufficient  depth  to  allow  her  to  pass.  This 
spawns  several  issues  for  further  investigation.  Given  that  the  tidal  depths  at  Milford  Flaven 
were  known,  why  did  the  company  elect  to  send  a  tanker  that  could  only  get  through  Milford 
Flaven  on  certain  days  (i.e.,  did  the  company  consider  lightening  the  TORREY  CANYON’S  load 
or  sending  a  different  vessel(s)  that  had  a  draft  more  compatible  with  the  tides  at  Milford 


®  Although  this  question  is  a  good  one  in  certain  sections  of  the  U.S.  where  fishing  reguiations  iimit 
fishing  seasons  to  oniy  a  day  or  two,  causing  greatiy  congested  waterways  on  those  days.  Asking  why  in 
these  cases  may  point  out  a  fiaw  in  the  reguiations,  showing  that  these  reguiations  need  to  consider  not 
oniy  conservation  but  waterway  mobiiity,  as  weii. 
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Haven?  -  potential  HFACS  Organizational  Influences  -  Resource  Management  issue)?  If  the 
TORREY  CANYON  had  gotten  into  Milford  Haven  too  late  to  make  the  high  tide,  how  would  that 
have  affected  the  captain?  Did  the  company  have  a  policy  which  would  have  penalized  the 
captain  for  missing  the  tide,  thus  encouraging  him  to  take  risks  (HFACS:  Organizational 
Influences  -  Organizational  Climate)?  Or,  perhaps,  was  this  a  self-imposed  pressure  due  to  the 
captain’s  pride  at  making  schedule  and  resulting  in  his  taking  unnecessary  risks  (Unsafe 
Supervision  -  Supervisory  Violation)?  There  is  an  obvious  tension  between  the  pressure  to 
make  good  time  and  safe  navigation.  Depending  on  how  it  evolved  (organizational  policy  or 
supervisory  deficiency),  the  appropriate  correction  will  vary. 

Finally,  we  have  the  causal  factor  of  the  steering  selector  switch  being  in  the  wrong  position. 
When  we  ask  why,  we  will  find  a  procedural  issue:  why  was  the  ship  on  autopilot  in  a 
hazardous  navigating  environment?  The  answer  to  this  question  could  be  a  combination  of 
factors  such  as:  it  was  put  there  inadvertently  (HFACS:  Unsafe  Act  -  Skill-based  Error);  it  was 
put  there  intentionally  to  allow  the  helmsman  to  do  another  task  (Unsafe  Act  -  Routine 
Violation);  or  perhaps  it  was  left  on  autopilot  too  long,  due  to  inadequate  bridge  team 
coordination  (Precondition  -  Substandard  Practices  -  Crew  Resource  Mismanagement).  Using 
the  human-system  approach,  we  might  ask  whether  there  was  a  suboptimal  interaction  between 
the  people  and  the  technology.  Specifically,  why  didn’t  the  helmsman  know  that  the  ship  was 
on  autopilot?  The  answer  is  that  there  was  no  indication  of  the  steering  selector  setting  at  the 
helm!  The  steering  selector  control  was  located  where  it  could  not  be  seen  when  standing  at 
the  helm.  Whereas  the  locus  of  this  error  is  the  interaction  between  the  user  and  the 
technology,  note  that  the  responsibility  lor  the  error  is  at  an  entirely  different  level.  On  the  one 
hand,  this  is  a  design  error  on  the  part  of  the  equipment  manufacturer;  however,  since  the 
company  most  likely  had  no  control  over  the  manufacturer’s  design,  this  is  not  a  useful  avenue 
to  pursue.  But  on  the  other  hand,  this  might  also  be  an  error  on  the  part  of  company 
management  for  selecting  and  purchasing  unsuitable  equipment  and-or  installing  it  in  an 
unsuitable  manner  (HFACS:  Organizational  Influences  -  Resource  Management). 

By  charting  first  the  primary  events  that  led  to  the  incident,  and  then  by  asking  why  until  the 
(many)  contributing  causes  are  found,  one  can  establish  the  reasons  why  an  incident  happened 
and  trace  the  layers  of  responsibility  from  the  individual(s)  to  the  preconditions,  to  supervisory 
errors,  and  to  unsafe  organizational  influences.  The  combination  of  Events  and  Causal  Factors 
Charting,  the  human-system  approach,  and  the  Human  Factors  Analysis  and  Classification 
System  (HFACS)  can  be  a  powerful  tool  for  ferreting  out  the  true  underlying  causes  of  incidents 
and  identifying  parts  of  the  system  which  need  to  be  corrected  in  order  to  prevent  recurrences  of 
similar  problems. 
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5.4  The  Art  of  Incident  Investigation 

Incident  investigation  is  somewhat  of  an  art.  It  takes  great  skill  to  build  a  rapport  with  and 
interview  people  associated  with  the  incident^®.  It  also  takes  a  great  deal  of  knowledge  about 
the  technical  and  human  factors  aspects  of  the  incident  to  ask  the  right  questions  and  identify 
the  important  issues  (this  is  the  reason  for  having  investigation  teams  -  no  one  person  is  likely 
to  have  all  the  requisite  skills  and  knowledge).  Likewise,  there  is  no  one  method  or  “best”  set  of 
questions  to  ask  that  will  work  for  all  investigations  (Appendix  H  gives  a  sample  of  human 
factors  questions  that  could  be  asked).  It  takes  experience  to  spot  potential  issues  and  to  know 
what  avenues  of  questioning  will  be  most  fruitful  in  a  particular  incident.  It  takes  experience  and 
skill  to  hunt  for  underlying  causes  and  to  fit  the  pieces  of  the  puzzle  together. 

Incident  investigation  is  also  not  a  serial  endeavor:  it  is  highly  iterative.  As  Figure  15  depicts, 
there  is  a  cyclical  process  of  gathering  information,  organizing  it  into  the  sequence  of  events 
and  causes  that  led  up  to  the  incident,  and  looking  for  the  underlying  human  factors  causes. 
Oftentimes  after  the  initial  round  of  interviews,  it  will  become  apparent  that  the  sequence  of 
events  has  missing  pieces,  or  that  some  of  the  information  appears  contradictory.  This 
necessitates  additional  interviews  or  re-interviews.  As  you  begin  to  feel  you  understand  the 
sequence  of  events,  you  may  find  that  you  still  lack  the  information  to  identify  the  types  of 
human  errors  that  were  made  and  the  underlying  causes  of  these  errors.  More  questioning  is 
needed.  Sometimes  an  exploration  of  the  human  errors  will  bring  to  light  that  the  sequence  of 
events  is  still  incomplete.  And  so  it  goes,  back  and  forth,  asking  questions,  organizing  data, 
finding  holes,  and  asking  more  questions,  until  you  can  finally  produce  a  set  of  events,  causes, 
and  underlying  human  errors  that  “hang  together”  and  make  a  sensible  explanation  for  how  the 
incident  evolved.  Patience  and  persistence  are  two  traits  of  successful  investigators! 

In  this  section  we  have  repeatedly  stressed  that  the  good  investigator  keeps  asking  “why?'  It  is 
useful  to  consider  when  to  stop  asking  why.  Asking  why  is  a  great  tool  for  identifying  underlying 
contributors  to  the  errors  that  caused  the  incident.  But  if  taken  to  extremes,  it  can  become 
almost  absurd.  In  general,  we  want  to  keep  asking  why  as  long  as  the  answer  is  still  something 
that  has  practical  significance  to  the  incident  and  is  under  the  company’s  control  to  make 
changes^V  In  the  TORREY  CANYON  incident,  for  example,  we  elected  nof  to  consider  why 


For  a  discussion  of  interviewing  techniques,  as  weii  as  other  good  materiai  on  the  coiiection  of 
evidence,  see  Center  for  Chemicai  Process  Safety  (in  preparation). 

There  are  times  when  we  do  want  to  iook  for  causes  that  are  beyond  the  company’s  controi.  Some 
incident  causes  have  ramifications  for  offshore  or  maritime  safety  in  generai  and  may  necessitate 
changes  to  equipment,  iegisiation,  or  codes  of  practice.  For  exampie,  if  a  reguiation  appeared  to  be  a 
cause  of  the  incident,  then  that  information  needs  to  be  brought  to  the  attention  of  the  appropriate 
authorities  so  that  the  reguiation  can  be  revised.  In  the  TORREY  CANYON  example,  the  poor  design  of 
the  steering  selector  mechanism,  because  it  could  easily  cause  similar  problems  for  others,  should  have 
been  discussed  with  the  manufacturer,  to  prompt  a  redesign,  and  reported  in  industry  publications  to 
warn  others  of  the  hazard.  While  the  main  thrust  of  this  paper  is  to  help  companies  use  human  factors 
incident  investigation  to  improve  their  own  safety,  we  all  have  the  responsibility  to  share  this  knowledge 
in  order  to  improve  the  safety  of  the  industry  as  a  whole. 
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there  were  so  many  fishing  vessels  in  the  channel,  because  that  was  totally  out  of  the  control  of 
the  company.  But  we  dide\ec\  to  consider  the  captain’s  response  to  those  fishing  vessels  (i.e., 
the  fact  that  he  did  not  slow  down),  because  his  response  is  within  his  (and  the  company’s) 
control.  There  will  always  be  extenuating  circumstances.  We  need  to  focus  on  how  the 
company  responds  to  those  circumstances  in  a  way  that  gets  the  job  done  safely. 


Working  Group  1  -  HFW2002 


Page  50  of  141 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


Begin  Investigation 


how? 


1.  Ask 
Questions 

V  "A., 


i 


why? 

why? 

why? 


3.  Identify  Human  Errors 


Locus: 

Human  System  Approach 


Responsibility: 

HFACS 


Jl 


No 


Is 

incident 
scenario  complete? 
Does  it  make 
sense? 


Yes 


Investigation 

Complete 


Figure  15.  The  Incident  Investigation  Process 
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6.0  Analyzing  Incident  Data 

Now  that  you’ve  been  running  your  incident  investigation  program  for  awhile,  what  do  you  do 
with  all  those  data?  There  are  many  ways  to  make  good  use  of  the  data  collected  from  incident 
investigations.  Here  are  a  few  ideas. 

6.1  Learning  from  Individual  Incidents 

This  is  the  simplest  way  to  learn  from  your  incident  investigation  program.  Individual  incidents 
can  be  discussed  at  safety  meetings,  allowing  personnel  to  gain  an  understanding  of  how 
different  incidents  evolved  and  how  an  accident  was  avoided.  This  type  of  information  sharing 
can  stimulate  discussion  of  similar  occurrences  and  potential  changes  to  procedures,  policies, 
training,  equipment  usage,  etc.  that  might  help  prevent  future  incidents. 

While  case-by-case  studies  can  be  beneficial,  they  have  a  drawback.  By  focusing  on  a  single 
incident,  there  is  no  way  to  know  what  facets  of  that  incident  may  represent  general  problems 
as  opposed  to  things  that  were  unique  to  that  particular  incident.  Most  companies  would  rather 
spend  their  money  fixing  frequently-occurring  problems  than  smaller,  once-in-a-lifetime 
problems.  The  way  to  get  a  feeling  for  the  importance  and  the  frequency  of  a  problem  is 
through  data  analysis,  and  several  approaches  to  analysis  are  discussed  below. 

6.2  Identifying  High-Risk  Activities  or  Facilities  Using  Simpie  Frequency  Analysis 

Frequency  analysis  can  be  an  effective  way  to  identify  problem  areas  on  which  you  need  to 
focus.  For  example,  say  an  offshore  drilling  company  has  three  rigs  and  wants  to  know  whether 
all  three  have  about  the  same  number  of  incidents.  A  simple  frequency  analysis  entails  adding 
up  the  number  of  incidents  reported  over  a  given  period  of  time  (e.g.,  one  year)  by  the  crews  of 
each  rig  (Fig.  16). 
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Figure  16.  Exampie  of  a  Frequency  Analysis 


Working  Group  1  -  HFW2002 


Page  52  of  141 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


In  the  example  shown  in  Figure  16,  it  is  obvious  that  Rig  C  has  reported  over  twice  as  many 
incidents  as  has  either  Rig  A  or  Rig  B.  Looks  like  Rig  C  has  a  problem,  right?  Well,  not 
necessarily.  You  need  to  go  deeper  and  find  out  why  Rig  C  has  reported  more  incidents. 
Maybe  the  crew  members  on  Rig  C  are  very  excited  about  the  new  incident  investigation 
program  and  are  being  vigilant  for  and  reporting  every  incident  that  arises,  while  the  crews  on 
Rigs  A  and  B  are  only  reporting  the  incidents  they  consider  to  be  “important”  in  some  respect. 
Or  maybe  Rig  C  is  larger,  does  more  operations,  and  has  more  people  working  on  it  than  either 
A  or  B  -  if  Rig  C  is  doing  four  times  the  work  that  is  done  by  either  Rig  A  or  B,  then  C’s  true 
incident  rate  would  actually  be  lower  than  that  on  A  or  B!  This  shows  the  necessity  for 
considering  how  to  make  an  “apples  to  apples”  comparison.  However,  if  Rigs  A,  B,  and  C  are 
roughly  equivalent  in  all  respects,  then  C  might  truly  have  a  safety  problem  that  needs  to  be 
identified  and  solved.  One  way  to  look  into  this  in  more  depth  would  be  to  do  more  frequency 
analyses  by  type  of  operation,  or  by  type  of  equipment  used,  or  by  some  other  relevant  factor. 
In  this  way  you  can  isolate  which  operations  or  equipment  appear  to  be  related  to  the  higher 
incident  rates  (for  example,  perhaps  when  looking  just  at  Operation  X,  Rig  C’s  incident  rate  is 
the  same  as  that  for  A  and  B;  but  when  looking  just  at  Operation  Y,  Rig  C’s  incident  rate  is 
much  higher  than  that  for  A  or  B). 

6.3  Looking  for  Trends 

A  simple  extension  of  the  frequency  analysis  discussed  above  is  to  compare  frequencies  over 
time  to  look  for  trends  in  the  data.  Perhaps  you  have  made  some  changes  to  a  standard 
operating  procedure  to  reduce  injuries.  Is  the  new  SOP  helping?  To  find  out,  you  could  plot  the 
number  of  injuries  in  the  years  prior  to  the  new  SOP  and  compare  that  to  the  number  of  injuries 
since  the  new  SOP  was  put  into  place.  Or  maybe  the  SOP  has  been  helpful  in  reducing  certain 
types  of  injuries  but  not  others.  A  plot,  like  that  presented  in  Figure  17,  could  help  the  company 
spot  areas  of  concern.  In  this  example,  most  of  the  injury  rates  are  fairly  consistent  over  the 
four  years  shown.  However,  three  injury  categories  show  some  interesting  changes.  “Struck 
By/Against”  and  “Slips/Trips/Falls”  both  show  marked  decreases.  In  this  particular  case,  the 
company  had  built  and  put  into  service  18  new  ships  in  1996-1999.  The  learning  curve  for 
operating  the  new  ships  may  have  contributed  to  exaggerated  “Struck  By/ Against”  rates  in  1998 
and  1999,  with  the  decrease  in  2000  showing  that  the  crews  had  become  familiar  with  the  new 
ships.  The  decreased  rate  of  slips,  trips,  and  falls  is  attributed  to  the  company’s  purchase  of 
new  safety  shoes  (designed  for  the  restaurant  industry  to  keep  traction  on  wet  floors)  -  a 
successful  safety  intervention!  The  third  item  of  interest  is  the  relatively  greater  rate  of  injuries 
in  the  “Chemical  Spray”  category  over  the  last  two  years.  This  appears  to  be  due  to  the  fact 
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Types  of  Injuries 
1Q98-3Q01 


Figure  17.  Example  of  a  Trend  Analysis 

(Data  courtesy  of  Stolt-Nielsen  Transportation  Group) 

that  new  crews  were  hired  to  man  some  of  the  newer  ships,  and  these  crew  members  did  not 
have  previous  experience  on  a  chemical  tanker.  Stolt  is  addressing  this  problem  with  an 
intensive  training  course  taught  by  experienced  Captains  and  Chief  Mates,  a  course  which  has 
proved  very  successful  in  the  past.  This  type  of  finding  alerts  a  company  to  the  need  for  getting 
additional  data  to  understand  the  contributing  causes  to  such  incidents  so  that  productive  safety 
interventions  can  be  designed  and  implemented. 

Frequency  and  trend  analysis  are  often  supplemented  with  cost  data  to  help  a  company  decide 
where  to  focus  its  next  safety  intervention.  While  frequency  data  tell  you  how  often  a  given  type 
of  incident  happens,  it  does  not  tell  you  the  severity  or  consequence  of  the  incident.  Therefore, 
it  is  helpful  to  combine  frequency  data  with  cost  (or  some  other  measure  of  severity)  to 
determine  which  types  of  incidents  are  most  in  need  of  controls.  For  example.  Figure  17  shows 
a  much  higher  frequency  of  slips,  trips,  and  falls  than  injuries  associated  with  temperature 
extremes.  Going  solely  by  the  frequency  data,  one  would  assume  the  slips,  trips,  and  falls  are 
more  important  to  control.  Flowever,  if  most  of  the  slips,  trips,  and  falls  have  a  relatively  minor 
consequence  (that  is,  the  injury  caused  is  mild),  then  it  may  not  warrant  much  attention.  Let’s 
say  that  on  the  average,  the  injury  caused  to  the  workers  in  these  slips,  trips,  and  falls  is  so 
minor  that  nothing  more  than  first  aid  is  needed  and  the  employee  can  return  immediately  to  the 
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job.  However,  let’s  say  that  the  result  of  the  average  injury  due  to  extreme  temperatures  (e.g., 
heat  stroke  or  frostbite)  requires  hospitalization  and  one  week  of  lost  time.  So  even  though  the 
frequency  oi  the  temperature-related  incidents  is  only  about  a  quarter  of  that  due  to  slips,  trips, 
and  falls,  their  severity  is  much  worse.  The  “total  cost”  (frequency  x  average  cost)  of  the 
temperature-related  incidents  is  much  greater  than  that  for  the  slips,  trips,  and  falls,  making  the 
reduction  of  temperature-related  incidents  a  higher  priority  for  the  company. 

A  word  of  warning  about  trend  analysis:  just  because  the  data  appear  to  show  a  trend  does  not 
necessarily  mean  there  really  is  a  significant  trend  present.  Data  can  be  highly  variable  (that  is, 
the  number  of  incidents  can  fluctuate  greatly  from  one  time  period  to  the  next).  It  is  not 
uncommon  to  see  rather  large  changes  in  the  numbers  of  incidents  from  year  to  year.  When 
you  are  dealing  with  a  small  number  of  data  points  (e.g.,  comparing  yearly  incident  frequencies 
from  1999  to  2000),  you  cannot  see  the  underlying  variability.  One  way  to  get  a  better 
appreciation  for  the  variability  is  to  look  at  the  data  by  month  or  by  quarter  instead  of  by  year. 
The  most  accurate  way  to  identify  true  differences  in  frequencies  and  establish  real  trends  is  by 
using  statistical  analysis  (for  example,  fitting  the  data  to  a  linear  function  (linear  regression)  and 
determining  whether  the  slope  is  significantly  different  from  zero). 

Both  frequency  analysis  and  looking  for  trends  are  ways  to  identify  operational  variables  that 
may  require  closer  examination.  Notice  that  while  the  frequency  or  trend  analysis  will  show  you 
areas  of  concern,  it  does  not  answer  the  question  as  to  why  these  differences  are  occurring. 
Once  you’ve  isolated  the  types  of  activities,  operations,  or  situations  of  interest,  you  can  use  the 
next  analysis  technique  to  explore  your  incidents  further. 

6.4  Looking  for  Similar  Incidents 

If  each  incident  report  is  coded  with  the  type  of  incident  (e.g.,  oil  spill),  and  the  activity  during 
which  it  happened  (e.g.,  filling  a  tank),  one  can  search  the  database  to  identify  all  the  incidents 
which  had  these  features  in  common.  One  immediate  advantage  to  this  is  it  helps  to  identify 
your  high-frequency  events.  Another  big  advantage  is  that  you  can  now  re-read  the  incident 
narratives  and  look  for  other  similarities  that  might  lead  to  the  identification  of  a  safety  hazard 
that  needs  to  be  fixed.  For  example,  in  the  case  of  spills  caused  by  overfilling  a  tank,  it  may  be 
that  an  overfill  alarm  needs  to  be  added,  or  that  the  standard  operating  procedure  needs  to  be 
changed  so  that  the  tank  is  continuously  monitored  by  a  crew  member,  and-or  the  fill  rate 
decreased  as  the  tank  gets  close  to  being  filled.  This  type  of  analysis  is  an  excellent  way  to 
identify  equipment  design  flaws  and  poor  operating  procedures.  The  FAA-sponsored,  NASA- 
run  Aviation  Safety  Reporting  System,  has  used  this  method  successfully  to  identify  equipment 
defects,  runway  design  problems,  and  to  make  improvements  to  air  traffic  control  protocols. 

6.5  Determining  Under  What  Conditions  a  Given  Error  Happens 

In  the  construction  of  the  incident  database,  it  can  be  useful  to  do  a  risk  assessment  of  various 
operations  to  identify  things  that  “might”  go  wrong.  The  database  can  then  be  used  to  see 
under  what  conditions  things  actually  do  go  wrong.  For  example,  in  a  study  of  communications 
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errors,  the  types  of  operations  that  depend  on  good  communications  were  identified  (e.g., 
vessel  navigation  with  a  marine  pilot  on  board  requires  good  communications  between  the  pilot 
and  the  ship’s  bridge  team;  safe  meeting  and  passing  agreements  depend  on  good  ship-to-ship 
communications).  The  potential  need  for  communication  was  then  tagged  in  the  database  by 
answering  five  simple  questions,  such  as  “Was  there  a  pilot  navigating?”  or  “Were  there  two  or 
more  vessels  involved  in  this  casualty?”.  In  analyzing  the  accident  data,  it  was  found  that  of  the 
accidents  in  which  one  of  these  five  questions  was  answered  “yes”,  76%  of  them  had  a 
communications  error  as  a  contributing  factor  to  the  accident.  This  is  a  powerful  way  to  identify 
high-risk  activities  and  situations. 

6.6  Looking  for  Underlying  Causes  Using  Meta-Analysis 

If  your  incident  investigators  are  adept  at  asking  “why”  enough  to  get  to  underlying  human  error 
causes,  then  you  can  use  your  incident  database  to  determine  which  types  of  causes  may 
precipitate  many  of  your  incidents.  To  extend  the  example  above  of  communications-related 
casualties,  the  incident  investigators  used  a  form  to  identify  specific  communications  problems, 
such  as  “did  not  communicate”,  “did  not  send  information  in  a  timely  manner”,  “message  was 
interrupted”,  “did  not  interpret  the  information  correctly”,  and  others.  For  each  problem 
identified,  the  investigator  went  on  to  consider  a  list  of  contributing  factors,  such  as  “inadequate 
knowledge  of  company  policies  for  communications”,  “limited  English  skills  or  knowledge”,  “did 
not  operate  communications  equipment  correctly”,  “distracted  or  interrupted  by  other  tasks”, 
“assumed  there  was  no  need  to  communicate”,  and  others  (see  App.  G  for  the  complete 
communications  investigation  protocol). 

A  frequency  analysis  of  the  communication  problems  showed  that  the  single  biggest  problem 
was  a  failure  to  communicate.  That  is,  in  68%  of  the  accidents,  someone  had  information  that 
could  have  prevented  the  accident,  but  chose  not  to  tell  anyone.  These  “failure  to 
communicate”  casualties  were  isolated  and  a  frequency  analysis  was  done  to  identify  the  most 
frequent  contributing  factors.  While  this  identified  factors  such  as  “incorrect  interpretation  of  the 
situation”,  “assumed  incorrectly  that  other  party  already  knows”,  and  others,  it  didn’t  give  a  good 
sense  of  what  might  be  at  the  crux  of  these  accidents. 

To  get  a  clearer  picture  of  what  was  going  on,  a  “meta-analysis”  was  done  in  which  the 
narratives  of  the  different  casualties  were  reviewed  and  additional  characteristics  of  the 
situations  were  identified.  The  result  was  the  finding  that  the  most  common  apparent  underlying 
cause  in  92%  of  these  “failure  to  communicate”  accidents  was  that  the  person  did  not  perceive 
a  safety  threat,  either  because  he  had  misinterpreted  the  situation  or  because  he  failed  to  think 
about  the  ramifications  of  the  situation  beyond  his  own  specific  job  responsibilities  (that  is,  he 
did  not  consider  how  his  actions  might  affect  other  people).  These  types  of  behaviors  show  a 
deficit  in  “situation  awareness”.  The  meta-analysis  also  showed  that  in  almost  half  of  these 
accidents,  there  was  a  second  person  who  did  not  speak  up.  This  person  perceived  the  safety 
threat,  but  assumed  it  was  not  his  job  to  say  anything  (he  assumed  someone  else  was  aware  of 


Working  Group  1  -  HFW2002 


Page  56  of  141 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


the  problem  and  would  take  care  of  it).  This  failing  shows  a  lack  of  “ship  resource 
management”.  The  meta-analysis  allows  one  to  go  beyond  the  specific  data  categories  in  the 
incident  database  and  to  find  underlying  causes  that  may  tie  other,  seemingly-disparate  causes 
together.  In  a  sense,  a  meta-analysis  is  like  putting  a  puzzle  together.  Each  database  element 
is  a  piece  of  the  puzzle,  but  the  meta-analysis  helps  us  see  how  to  put  the  pieces  together  and 
get  greater  meaning  from  them.  In  this  case,  it  was  the  meta-analysis  which  most  effectively 
pointed  us  at  the  true  underlying  problems,  suggesting  the  types  of  interventions  (improvements 
in  situation  awareness  and  ship  resource  management)  that  would  be  productive. 

6.7  Identifying  Relationships  Among  Incident  Attributes  by  Statistical  Analysis 

Statistics  can  be  used  to  draw  out  meaningful  relationships  among  elements  of  incidents,  and 
sometimes  they  can  be  used  to  infer  probable  cause.  Statistical  analysis  was  used  in  a  couple 
ways  in  a  recent  study  of  fatigue-related  accidents  (McCallum,  Raby,  &  Rothblum,  1996).  The 
purpose  of  the  research  was  to  understand  not  only  how  many  marine  accidents  were  related  to 
fatigue,  but  also  to  look  for  underlying  contributing  factors  (in  other  words,  what  was  causing  the 
fatigue).  A  database  was  established  using  scientific  literature  to  identify  the  questions  that 
should  be  asked  (the  resulting  fatigue  investigation  questions  can  be  found  in  App.  G).  The 
fatigue  investigation  was  administered  during  routine  casualty  investigations,  and  the  database 
was  used  to  find  out  what  attributes  were  significantly  related  to  fatigue  (that  is,  what  data  items 
had  statistically  different  values  in  the  fatigue-related  accidents  compared  to  accidents  that  did 
not  result  from  fatigue).  One  set  of  tests  looked  at  the  number  of  hours  worked  by  mariners  who 
caused  injuries  (either  to  themselves  or  to  another  crew  member). 

The  statistical  tests  {t-tests)  determined  that  the  number  of  hours  on  duty  at  the  time  of  the 
accident,  and  the  number  of  hours  worked  in  the  last  24/48/72  hours  were  all  significantly 
different  for  the  fatigue-related  and  non-fatigue  injury  cases.  The  averages  for  each  of  these 
comparisons  are  plotted  below  (Fig.  18).  One  must  be  careful  about  jumping  to  causal 
conclusions.  In  some  cases,  the  difference  seen  between  two  groups  may  be  due  to  something 
very  different  than  what  is  being  tested  (remember  our  example  of  the  number  of  incidents 
reported  by  the  different  oil  rig  crews).  However,  in  this  case,  the  scientific  literature  supports 
the  relationship  between  long  work  hours  and  increasing  fatigue.  Therefore,  these  data  were 
taken  as  strong  evidence  that  an  underlying  cause  of  these  fatigue-related  injuries  was  long 
work  hours. 

Statistical  analysis  was  used  a  second  way  in  this  study.  It  was  used  to  consider  all  the 
different  factors  that  were  correlated  with  fatigue-related  accidents  and  to  come  up  with  a  quick 
“screening  test”  for  fatigue.  Because  the  full  fatigue  investigation  took  about  40  minutes,  it  was 
desirable  to  find  a  few  questions  that  would  indicate  whether  fatigue  appeared  to  play  a  role, 
and  whether,  therefore,  the  investigator  should  collect  all  the  fatigue  data.  A  multiple  regression 
analysis  was  performed  to  determine  which  factors  were  most  predictive  of  fatigue-related 
casualties.  The  result  was  a  simple  Fatigue  Index  equation  consisting  of  just  three  questions 
(the  number  of  hours  slept  in  the  last  24  hours,  the  number  of  hours  worked  in  the  last  24  hr.. 
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Figure  18.  Result  of  Statistical  Analysis  of  Incident  Database  Items 

(from  McCallum,  Raby,  &  Rothblum,  1996) 

and  the  number  of  fatigue  symptoms  experienced  by  the  mariner).  When  the  data  from  both 
the  fatigue  and  non-fatigue  casualties  were  put  into  this  equation,  it  was  found  to  be  80% 
correct  in  its  ability  to  identify  whether  a  given  casualty  was  fatigue-related  or  not  (the  fatigue 
index  worksheet  is  in  App.  G). 

The  purpose  of  statistical  analysis  is  to  determine  whether  apparent  differences  in  data  points 
are  just  due  to  the  variability  of  the  data  or  whether  they  are  due  to  a  true  underlying  difference 
or  trend.  For  example,  in  Figure  17,  the  incidence  of  “caught  between”  injuries  varies  greatly 
over  the  four  years  shown.  Is  the  downward  trend  from  1999  through  2001  “real”,  or  is  it  just  a 
matter  of  the  normal  variability  of  the  data?  Statistical  tests  can  be  used  to  determine  this.  It 
should  be  noted  that  just  because  something  turns  out  to  be  “statistically  significant”,  it  does  not 
necessarily  mean  that  it  is  “important”  or  significant  in  practical  terms.  The  size  of  the 
significant  difference  could  be  very  small.  For  example.  Figure  16  compared  the  number  of 
incidents  on  three  drilling  rigs.  It  might  be  that  the  incident  rate  on  Rig  B  is  significantly  lower 
than  the  rate  on  Rig  A.  But  since  both  have  a  relatively  low  rate  of  incidents,  from  a  practical 
standpoint,  the  difference  just  isn’t  interesting  (not  worthy  of  taking  action). 

6.8  After  the  Analysis 

Webster’s  Dictionary  (G  &  C  Merriam  Company,  1973)  defines  data  as,  “factual  information  (as 
measurements  or  statistics)  used  as  a  basis  for  reasoning,  discussion,  or  calculation.”  The 
operative  word  is  basis.  The  analysis  of  incident  data  serves  as  nothing  more  than  a  basis  or  a 
point  of  departure  for  discussion,  reasoning,  and  perhaps  additional  study.  It  is  not  until  the 
data  have  been  pondered,  organized,  understood,  and  put  into  proper  context  that  these  bits  of 
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disparate  facts  turn  into  valuable  and  useful  information.  This  subsection  discusses  two  areas 
in  which  one  needs  to  go  beyond  the  data  analysis  in  order  to  fully  understand  the  data  and  take 
appropriate  action. 

6.8.1  Data-Driven  Research:  the  Link  Between  Data  Analysis  and  Solving  Safety  Problems 

You  cannot  solve  safety  problems  simply  by  analyzing  incident  data.  In  general,  the  analysis  of 
incident  data  will  identify  a  potential  problem  that  then  needs  to  be  studied  before  it  can  be 
solved.  For  example,  if  you  plot  your  company’s  injury  data  and  find  that  a  large  percentage  of 
the  injuries  are  from  slips,  trips,  and  falls,  you  have  identified  a  problem,  but  not  a  solution.  The 
next  step  would  be  to  investigate  further  and  understand  what  seems  to  be  causing  the  slips, 
trips,  and  falls.  Where  do  these  injuries  occur  and  under  what  conditions?  Are  deck  surfaces 
slippery  or  are  stairway  treads  worn?  Have  personnel  been  provided  with  proper  footwear,  and 
if  so,  are  they  wearing  it?  (You’d  be  surprised  at  the  number  of  times  companies  provide 
personnel  protection  gear  of  one  sort  or  another,  only  to  find  that  employees  refuse  to  use  it 
because  it’s  either  uncomfortable  or  interferes  in  some  way  with  other  aspects  of  their  jobs. 
Protective  gear  must  be  designed  to  be  compatible  with  the  workers’  needs  and  workplace 
tasks.) 

As  was  discussed  earlier  (see  Fig.  8  in  Sec.  3),  the  analysis  of  incident  data  is  the  precursor  to 
data-driven  research  used  to  understand  the  problems  identified  by  the  analysis.  “Research” 
may  be  as  simple  and  low-tech  as  a  discussion  with  employees  and  line  supervisors  to  get  their 
perceptions  of  the  problems  and  potential  solutions,  or  it  can  be  as  detailed  and  intensive  as  a 
full-blown  scientific  study.  The  point  is  that  the  analysis  of  the  incident  data  is  a  starting  point, 
and  that  it  takes  follow-up  study  to  understand  the  genesis  of  a  problem  and  to  devise 
successful  safety  interventions. 

6.8.2  It  May  Be  Data,  But  It’s  Not  Necessarily  Telling  You  Anything 

One  final  caution:  a  database  is  only  as  good  as  the  data  that  are  put  into  it.  If  the  investigator 
doesn’t  ask  all  the  relevant  questions,  the  database  cannot,  by  definition,  have  the  relevant 
data.  This  harks  back  to  the  recommendations  given  in  Section  3  for  building  a  successful 
incident  investigation  program.  If  the  company  does  not  promote  an  open,  fair,  and 
improvement-oriented  culture,  or  if  there  isn’t  a  common  understanding  about  the  scope  and 
purpose  of  the  incident  investigation,  or  if  the  investigators  are  not  appropriately  trained,  or  if  the 
incident  database  is  hard  to  use,  the  data  that  populate  the  incident  database  may  be  less  than 
accurate  and  complete.  Obviously,  analyses  based  on  such  data  will  be  of  questionable  value 
(“garbage  in,  garbage  out”). 

Even  with  the  best  of  intentions,  things  may  happen  which  affect  the  database.  For  example,  a 
simple  change  in  policy  affecting  which  incidents  will  be  investigated  may  result  in  the 
appearance  of  a  greatly  increased  (or  reduced)  incident  rate  when  comparing  data  from  periods 
before  and  after  the  policy  went  into  effect.  Let’s  say  a  company  decides  to  forego  incident 
investigation  on  any  incident  which  costs  the  company  less  than  $10,000.  If  there  are  types  of 
incidents  which  are  predominantly  low-cost,  the  frequency  of  those  incidents  will  appear  to  be 
dramatically  reduced  after  the  policy  takes  effect  (even  though  the  true  frequency  of  the 
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incidents  has  not  changed,  or  even  increased  -  they  just  aren’t  being  investigated  anymore). 
Training  for  investigators  may  result  in  a  better  understanding  of  the  classification  scheme  (such 
as  HFACS)  they  are  using.  While  this  should  result  in  improved  data  reliability  in  the  future,  it 
may  also  give  the  appearance  of  changes  in  certain  types  of  incident  rates  (because  some 
incidents  may  have  been  misclassified  prior  to  the  training). 

Never  put  blind  faith  in  your  incident  data  analysis:  always  be  on  the  lookout  for  procedural  or 
other  reasons  (unrelated  to  actual  incident  rates)  that  might  be  affecting  the  analytic  process. 
Keep  records  of  changes  made  to  the  database,  investigation  policy,  and  investigator  training  - 
these  could  be  great  time-savers  in  understanding  “mysterious”  trends.  Keeping  records  of 
important  company  policy  or  procedural  changes  can  also  be  helpful  in  understanding  changes 
in  incident  frequencies.  The  more  you  know  about  changes  in  the  way  you  do  business  -  both 
in  the  company  at  large  and  in  the  incident  investigation  program  specifically  -  the  better  you 
will  be  able  to  differentiate  between  spurious  “trends”  and  true  safety  issues. 

6.9  Summary  of  Analysis  Techniques 

Data  analysis  can  be  used  to  identify  areas  in  need  of  safety  interventions.  Oftentimes,  data 
analysis  shows  an  interesting  trend,  but  does  not  give  you  sufficient  information  to  take  action. 
This  will  require  follow-up  studies  to  better  define  the  problems  and  suggest  workable  solutions. 
Data  analysis  can  also  point  out  where  the  database  and-or  investigation  procedures  are 
lacking.  For  example,  you  may  find  out  the  company  has  a  high  rate  of  slips,  trips,  and  falls  - 
but  that  doesn’t  tell  you  enough  about  the  problem.  The  database  might  need  to  be  modified  to 
add  information  on  the  types  of  slips,  trips,  and  falls  (e.g.,  where  they  occur,  what  operations 
were  in  progress,  how  much  lost  time  resulted),  and  the  incident  investigators  may  need  to  ask 
additional  questions  to  illuminate  the  causes  of  these  accidents.  Recall  that  Figure  8  shows  a 
feedback  loop  from  Database  Analysis  back  to  Incident  Investigation.  Data  analysis  is  a  great 
way  to  learn  about  the  strengths  and  weaknesses  of  your  investigation  methods  and  database. 

This  section  has  provided  examples  of  ways  you  can  learn  from  your  incident  data.  Frequency 
analysis  and  looking  for  trends  are  simple  procedures  that  anyone  can  do  quickly  with  the  aid  of 
a  spreadsheet  application.  Looking  for  similar  incidents  and  determining  conditions  which  tend 
to  be  associated  with  them  are  fairly  simple  procedures,  although  a  database  with  relevant 
index  variables  is  helpful  for  doing  such  analyses  efficiently.  Statistical  analysis,  while  requiring 
more  expertise  on  the  part  of  the  safety  analyst,  can  provide  great  benefits  by  finding  underlying 
correlations  and  relationships.  The  important  thing  is  not  to  let  your  incident  data  just  sit  there: 
analyze  it  and  make  it  work  for  you. 
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7.0  Finding  Safety  Solutions 

Let’s  say  you’ve  collected  incident  information  and  run  some  analyses.  Now  you  want  to 
develop  measures  to  prevent  these  incidents  from  recurring.  What  do  you  do?  How  do  you  find 
solutions  that  will  be  effective?  Oftentimes,  finding  effective  solutions  is  elusive.  A  study  of 
offshore  operations  in  an  international  oil  and  gas  company  demonstrates  what  can  happen 
(Bryden,  O’Connor,  &  Flin,  1998).  This  company  had  an  incident  investigation  program.  The 
database  contained  information  on  technical  and  human  factors  causes  of  the  incidents  and 
suggested  remedial  actions.  Analysis  of  the  recommended  remedial  actions  showed  that  only 
10%  of  them  addressed  the  underlying  causes  of  the  incidents,  while  another  31%  addressed 
only  direct  causes  and  no  underlying  causes.  The  shocker  was  that  59%  of  the  recommended 
remedial  actions  were  “quick  fixes”  which  did  not  address  the  causes  of  the  incidents  at  all!  The 
ineffective  quick  fixes  tended  to  be  things  such  as  telling  the  worker  not  to  do  it  again,  or 
mentioning  the  danger  at  the  next  safety  meeting.  A  safety  program  based  on  trying  to  motivate 
the  worker  not  to  repeat  a  dangerous  action,  without  taking  steps  to  solve  the  underlying 
causes,  is  doomed  to  failure. 

On  the  other  hand,  it  is  not  so  surprising  that  companies  might  fall  into  such  a  “quick  fix”  trap. 
One  might  say  that  the  biggest  problem  with  having  a  successful  incident  investigation  program 
is  that  now  there  are  data  about  which  management  must  not  only  think,  but  also  do  something 
constructive!  Perrow  put  it  this  way  (Perrow,  1986,  as  quoted  by  Hollnagel,  2000,  p.1): 

Formal  accident  investigations  usually  start  with  an  assumption  that  the  operator 
must  have  failed,  and  if  this  attribution  can  be  made,  that  is  the  end  of  serious 
inquiry.  Finding  that  faulty  designs  were  responsible  would  entail  enormous 
shutdown  and  retrofitting  costs;  finding  that  management  was  responsible  would 
threaten  those  in  charge;  but  finding  that  operators  were  responsible  preserves 
the  system,  with  some  soporific  injunctions  about  better  training. 

Remember  Reason’s  (1990)  Swiss  cheese  model  -  each  slice  of  cheese  (excluding  unsafe 
acts)  represents  a  layer  of  system  defenses.  The  fact  that  incidents  are  occurring  means  that 
one  or  more  of  these  layers  of  system  defenses  requires  repair:  they  are  not  effective  barriers 
to  prevent  unsafe  outcomes.  Hollnagel  (2000),  like  Reason,  has  suggested  that  in  order  to 
prevent  incidents,  we  must  go  beyond  finding  a  single  “root  cause”  (or  making  the  operator  the 
scapegoat,  per  Perrow)  and  understand  how  to  improve  the  barriers  (system  defenses). 
Barriers  can  either  avert  an  incident  from  taking  place,  or  reduce  the  magnitude  of  the  negative 
consequences  (prevention  and  mitigation,  respectively,  as  depicted  in  Fig.  8). 

7.1  The  Triangle  of  Effectiveness:  A  Guide  to  Safety  Interventions 

Gerry  Miller  (2000;  Miller  et  al.,  1997)  adds  his  voice  to  those  of  Reason  and  Hollnagel  in 
decrying  the  past  tendency  to  place  the  blame  for  industrial  incidents  solely  on  “operator  error”. 
Instead,  it  is  his  contention  that  even  the  most  safety-conscious  employee  will  occasionally 
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initiate  unsafe  acts  at  the  job  site,  and  that  sometimes  these  acts  are  encouraged,  led,  or  even 
coerced  upon  the  employee  by  a  variety  of  factors  beyond  the  employee’s  control.  However, 
Miller  states  that  these  acts  can  be  prevented,  or  at  least  the  consequences  of  the  acts 
mitigated,  through  the  application  of  barriers  or  safety  interventions.  He  illustrates  this  concept 
through  his  “triangle  of  effectiveness”  (see  Fig.  19),  which  presents  eight  levels  of  barriers  that 
can  be  used  to  prevent  or  mitigate  incidents^^.  Starting  at  the  base  of  the  triangle,  these  eight 
elements  are: 

•  Policies  and  culture^^  -  management  policies  and  corporate  culture  which  promote  a 
safe,  human-centered  work  environment; 

•  Workplace  design  -  ergonomically-designed  and  arranged  equipment; 

•  Environmental  control  -  keeping  lighting,  temperature,  noise,  etc.  within  human- 
compatible  ranges; 

•  Personnel  selection  -  selecting  the  right  people  for  the  job; 

•  Training  and  standard  operating  procedures  (SOPs)  -  ensuring  workers  have  the 
necessary  knowledge  and  skills  to  do  the  job,  and  that  SOPs  are  correct  and 
consistent  with  best  practices; 

•  Interpersonal  relationships  (communication)  -  the  exchange  of  necessary 
information  between  team  members; 

•  Job  aids  -  understandable,  easy-to-use  task  instructions  and  warning  placards; 

•  Fitness  for  duty  -  ensuring  that  workers  are  alert,  focused,  and  capable  of  safe  job 
performance. 

All  eight  barriers  are  important.  Miller  concludes,  and  must  be  included  in  a  total  behaviorally- 
based  safety  program.  It  should  be  emphasized,  however,  that  the  elements  at  the  base  of  the 
triangle  (i.e.,  policies  &  culture,  workplace  design,  and  environmental  control)  have  the  most 
significant  impact  on  safety  and  should  form  the  backbone  of  a  company’s  safety  program. 
(Each  of  these  eight  barriers  will  be  discussed  in  more  detail  in  the  next  section) 

In  Reason’s  model,  these  elements  (at  the  base  of  the  triangle)  are  controlled  by  the 
“Organizational  Factors”  layer  of  defenses.  When  the  organization  (company  management) 
makes  poor  decisions,  such  as  the  selection  of  equipment  which  is  not  designed  to  support  the 

Miller  uses  this  triangle  both  as  a  model  for  accident  causation  and  as  a  guide  to  selecting  safety 
interventions.  Like  Reason’s  framework,  Miller’s  emphasizes  the  multiplicity  of  causes  of  a  given 
incident  and  attributes  the  causes  to  the  lack  or  failure  of  barriers  (system  defenses  in  Reason’s  jargon). 
In  this  paper  we  have  chosen  to  focus  on  Miller’s  triangle  as  a  means  for  selecting  interventions,  since  it 
bridges  the  gap  between  Reason’s  organizational  model  of  system  defenses  (management  -  line 
supervisor  -  worker)  and  the  concrete  needs  of  a  shipping  or  offshore  company  to  select  specific  means 
to  solve  identified  safety  problems. 

Miller  calls  this  factor  “Management  Participation”.  Workshop  participants  felt  “Policies  and  Culture” 
was  a  more  intuitive  label. 
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human  operator,  that  single  poor  decision  has  an  enormous  “trickle  down”  effect  because  so 
many  operators  and  operations  are  affected.  Such  poor  decisions  at  the  Organizational  Factors 
layer  very  often  become  latent  contributors  to  incidents.  In  a  similar  fashion,  good  decisions 
made  at  the  Organizational  Factors  layer,  such  as  the  selection  of  well-designed  equipment  (or 
other  human-centered  decisions  contained  at  the  base  of  the  triangle),  contribute  very  positively 
to  the  safety  program,  again  because  of  the  numbers  of  people  and  operations  they  touch. 

Interventions  based  solely  on  elements  at  the  top  of  the  triangle  (such  as  fitness  for  duty  and  job 
aids)  will  have  the  least  impact  on  workplace  safety,  and  therefore  should  have  a  lesser 
emphasis  within  the  company’s  safety  program.  The  factors  at  the  top  of  the  triangle  depend 
primarily  on  the  actions  of  individual  workers.  Interventions  at  this  level  are  on  a  one-by-one 
basis  -  a  less  efficient  and  less  effective  way  of  dealing  with  safety  issues. 


Figure  19.  The  “Triangle  of  Effectiveness”  for 

Safety  Interventions  to  Reduce  Human  Error 

(after  Miller,  2000) 
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An  example  will  help  to  clarify  this.  Let’s  say  Joe  needed  emergency  medical  attention  because 
he  accidentally  sheared  off  one  of  his  fingertips  while  cutting  metal  sheeting  to  make  a  repair. 
Telling  Joe  to  “be  more  careful”  will  not  likely  have  a  big  impact  on  safety.  Training  all  the  repair 
crews  on  the  correct  procedure  for  cutting  sheet  metal  will  have  more  of  an  impact,  since  more 
of  the  workforce  is  made  aware  of  the  problem  and  a  way  to  protect  themselves  (assuming,  of 
course,  that  supervision  and  peer  pressure  encourage  and  reinforce  their  behavioral  changes). 
But  the  best  way  to  prevent  this  type  of  incident  is  by  having  equipment  that  has  been  designed 
with  a  “guard”  to  prevent  one’s  fingers  from  contacting  the  cutting  mechanism  (workplace 
design  level). 

Hollnagel  (2000)  points  out  that  the  purpose  of  an  incident  investigation  program  is  to  identify 
barriers  (system  defenses)  that  have  failed  or  barriers  that  were  missing  which  allowed  an 
incident  to  happen.  A  good  safety  intervention  program  repairs  and-or  develops  as  many  of 
these  barriers  as  possible.  Miller’s  (2000)  addition  to  this  line  of  thinking  is  that  when  it  is  not 
possible  to  implement  all  the  relevant  barriers,  selecting  those  towards  the  base  of  the  triangle 
will  reap  better  protection  than  selecting  only  those  towards  the  tip.  Just  as  we  need  to  probe 
deeper  to  find  the  underlying  latent  factors  which  cause  incidents,  we  also  want  to  make  safety 
“fixes”  and  focus  our  safety  program  at  the  deepest  levels  possible  (at  the  base  of  the  triangle). 

7.2  Relationship  Between  Reason’s  “Slices  of  Cheese”  and  the  Triangle  of 
Effectiveness 

As  shown  in  Figure  20,  different  layers  of  system  defenses  are  related  to  different  elements 
within  the  triangle  of  effectiveness.  The  Organizational  Factors  layer  has  the  greatest  span  of 
control,  and  therefore,  the  greatest  capacity  for  effective  intervention.  Remember  that 
“organizational  factors”  refers  to  the  policies,  procedures,  and  decisions  put  into  place  by  upper 
management.  Management  is  usually  responsible  for  designing  the  procedures  and  developing 
the  work  policies  implemented  by  the  line  supervisors  and  workers.  As  such,  this  layer  of 
system  defenses  can  influence  seven  of  the  eight  elements  within  the  triangle  of  effectiveness, 
and  is  the  only  layer  of  defense  which  can  effectively  impact  the  most  important  lower  three 
elements  (see  top  of  Fig.  20). 

The  Supervision  layer  of  defenses  represents  the  interventions  that  can  be  controlled  by  line 
management.  Note  that  whereas  the  organizational  factors  layer  is  generally  in  charge  of 
designing  and  developing  policies  and  procedures,  supervisors  are  responsible  for  carrying  out 
those  policies  and  procedures.  This  automatically  limits  the  effectiveness  that  supervisors  can 
exert,  since  they  often  cannot  change  existing  policies  and  procedures,  only  report  back  on 
those  which  may  appear  to  be  latent  factors  in  incidents.  The  middle  section  of  Figure  20 
displays  the  types  of  interventions  to  which  supervisors  can  contribute.  While  they  are  not 
always  directly  involved  in  hiring  and  firing,  line  supervisors  generally  are  involved  in  “personnel 
selection”  from  the  standpoint  of  assigning  people  to  tasks.  In  a  similar  vein,  while  they  might 
not  be  involved  in  training  or  writing  standard  operating  procedures  (SOPs),  they  are 
responsible  for  seeing  that  these  are  properly  carried  out.  They  may  also  be  the  ones  who 
recommend  workers  for  remedial  or  advanced  training. 
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The  worker  has  the  smallest  span  of  control  over  safety  interventions.  The  worker’s  level  is 
basically  contained  within  the  layer  of  system  defense  called  “Preconditions  for  Unsafe  Acts”.  It 
becomes  the  worker’s  responsibility  to  adhere  to  standard  operating  procedures,  learn  to  use 
equipment  properly,  communicate  clearly,  use  job  aids  when  needed,  and  to  stay  fit  for  duty.  If, 
for  example,  a  standard  operating  procedure  is  deficient  or  a  management  work-rest  schedule 
causes  excessive  fatigue  on  the  job,  the  worker’s  span  of  control  is  too  limited  to  allow  for 
meaningful  intervention  at  that  level.  This  is  why  it  is  so  important  to  look  for  interventions  at 
the  base  of  the  triangle,  at  the  organizational  factors  layer  of  system  defense. 

Now  let’s  discuss  each  the  intervention  elements  within  the  “triangle  of  effectiveness”  and  see 
how  they  relate  to  the  “layers  of  system  defenses”. 

7.2.1  Policies  &  Culture 

Management  policies  and  corporate  culture  depend  on  the  active  participation  of  upper 
management  in  promoting  a  human-centered  work  environment  and  worksite.  As  such,  policies 
and  culture  are  key  to  an  effective  error  reduction  program:  they  are  the  base  on  which 
everything  else  rests.  Management  participation  should  be  demonstrated  in  a  variety  of  ways. 
It  should  be  visible  in  its  support  and  active  encouragement  of  an  open,  “safety  first”  corporate 
culture,  where  “safety  first”  is  not  just  a  motto  but  a  corporate  mission.  An  atmosphere  that 
provides  incentives  for  personnel  to  question  and  improve  work  environments  and  standard 
operating  procedures  shows  a  caring  management  philosophy.  Management  actions  and 
decisions  should  be  human-centered,  enabling  the  best  personnel  performance.  Examples  of 
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Figure  20.  Types  of  Interventions  Needed  to  Plug  the  “Holes”  in  the  Layers 

of  Defenses. 

Different  layers  of  system  defenses  (“slices  of  cheese”  at  left)  can  be 
bolstered  by  -  and  have  the  power  to  implement  -  different  sets  of 
interventions  (unshaded  elements  in  the  triangles). 
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how  management  can  demonstrate  its  commitment  to  a  good  employee  safety  program  include 
establishing  safe  work  loads  and  schedules  based  on  known  human  physiological  limitations 
and  requirements  (e.g.,  work-rest  cycles);  the  creation  of  easily-understood  and  achievable 
company  policies  and  practices;  the  establishment  and  consistent  application  of  rewards  (or 
punishments)  for  compliance  (or  lack  thereof)  with  company  policies;  creation  of  reasonable 
product  delivery  schedules;  providing  physical  facilities  and  equipments  designed  to  match 
human  capabilities  and  limitations;  insistence  on  good  facility  maintenance;  and  a  commitment 
to  uncovering  the  underlying  causes  of  incidents.  By  definition,  management  policies  and 
corporate  culture  are  a  part  of  the  “Organizational  Factors”  level  of  defenses.  Whenever  such 
organizational  factors  (like  the  examples  just  given)  are  discovered  during  an  incident 
investigation,  management  policies  and  culture  should  be  considered  when  designing 
interventions  to  stop  future  such  incidents. 

7.2.2  Workplace  Design 

Good,  ergonomic  workplace  design  can  be  extremely  effective  in  reducing  incidents.  As 
underscored  earlier  in  this  paper,  poor  design  of  vessels,  platforms,  equipment,  and  work 
environments  is  an  underlying  precondition  that  can  “set  up”  the  human  operator  to  make 
errors.  In  fact,  the  American  Bureau  of  Shipping  states  that  88%  of  shipboard  injuries  and  50% 
of  fatalities  are  the  result  of  poor  design  (McCafferty,  2000).  Unfortunately,  examples  of  poor 
design  abound  in  the  maritime  industry.  As  Miller  says  (2000,  p.  7),  “You  cannot  overcome 
human  errors  induced  by  poor  design  of  the  work  place  with  more  training,  more  manuals  or 
written  procedures,  exhortations  to  work  safer,  or  threats  of  punitive  actions  for  job  accidents.” 

Good  design  is  not  a  mystery:  there  have  been  decades  of  human  factors  research  into  a 
plethora  of  design  facets.  Further,  there  has  been  considerable  experience  acquired  over  the 
past  decade  in  the  offshore  and  shipping  industries  with  applying  FIFE  design  criteria  to  new 
and  remodeled  facilities.  In  addition,  well-established  and  accepted  human  factors  design 
standards  and  guidance  now  exist  for  the  maritime  industry  (ASTM,  1995;  American  Bureau  of 
Shipping  [ABS],  1998;  ABS,  2001).  In  fact,  when  FIFE  design  principles  are  introduced  at  the 
beginning  of  the  design  of  a  facility  or  system,  it  can  drastically  reduce  life-cycle  costs  and 
prevent  the  need  for  costly  modifications  down  the  road  (because  it  was  built  right  the  first  time). 

Good  workplace  design  requires  proactive  management  involvement;  it  is  almost  always 
beyond  the  span  of  control  of  the  workers  or  line  supervision.  Thus,  incidents  resulting  from 
workplace  design  flaws,  even  though  some  may  be  considered  “equipment  preconditions”,  must 
look  to  the  Organizational  Factors  layer  of  the  organization  for  effective  safety  interventions. 

7.2.3  Environmental  Control 

Lack  of  environmental  control  is  another  widespread,  latent  cause  of  maritime  and  offshore 
incidents.  This  element  of  the  triangle  refers  to  the  work  environment:  temperature,  humidity. 
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lighting,  noise,  and  vibration.  Human  beings  have  “safe  operating  ranges”  just  like  equipment. 
Put  a  human  in  an  environment  that  is  outside  his  safe  operating  range,  and  he  becomes  an 
accident  waiting  to  happen.  Miller  (2000,  p.8)  relates  an  all-too-frequent  occurrence: 

As  just  one  example,  studies  have  shown  that  crane  accidents  are  the  second 
most  frequent  cause  of  injuries  and  fatalities  on  offshore  platforms  in  the  Gulf  of 
Mexico  (GOM).  Yet,  operator  cabs  on  these  cranes  are  traditionally  not 
environmentally  controlled.  Some  years  ago  during  a  visit  to  an  offshore  platform 
it  was  noted  ...  [that  the  temperature  inside  a  crane  cab  was]  122  degrees  F. 

With  this  combination  of  heat  and  July  GOM  humidity  is  it  any  wonder  that  an 
operator  error  of  omission  (i.e.  the  operator  did  not  complete  an  act  that  he  was 
suppose  to  have  done)  occurred  that  day  resulting  in  damage  to  the  crane  and 
platform. 

Emphasizing  the  importance  of  proper  workplace  environments,  the  American  Bureau  of 
Shipping  (ABS)  has  prepared  human  performance-based  environmental  standards  for  both 
ships  and  offshore  structures.  These  standards  will  be  issued  in  2002. 

7.2.4  Personnel  Selection 

It  has  long  been  recognized  that  certain  jobs  require  special  physical,  mental,  or  social  skills  not 
possessed  by  everybody  who  would  like  to  work  in  those  jobs.  Finding  the  right  people  for  the 
job  is  what  personnel  selection  is  all  about.  As  an  example,  special  physical  and  psychological 
screening  tests  have  been  used  for  at  least  the  last  thirty  years  in  the  public  safety  sector  to 
screen  out  those  who  would  not  be  suitable  for  the  law  enforcement  or  fire  safety  professions.  If 
a  person  is  selected  to  work  in  a  job  for  which  he/she  is  not  suited,  that  can  result  in  an 
increased  probability  of  that  person  contributing  to  a  workplace  accident. 

Personnel  selection  should  consider  the  personality  traits  and  special  abilities  needed  for  a 
given  job.  Just  because  someone  has  the  desire  to  work  in  a  particular  job,  or  even  has  spent 
twenty  years  working  elsewhere  in  the  company,  that  doesn’t  necessarily  qualify  that  person  for 
the  open  position.  A  given  job  may  have  certain  physical  requirements  (e.g.,  good  color  vision 
for  an  electrician,  or  good  visual  acuity  and  depth  perception  for  a  crane  operator),  as  well  as 
intellectual  aptitudes  (e.g.,  good  communication  skills  for  a  supervisor)  and  psychological 
requirements  (e.g.,  good  judgement  and  coolness  under  stress  for  a  ship  master  or  offshore 
installation  manager). 
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As  a  “barrier”  to  incidents,  personnel  selection  is  active  at  two  different  levels.  The 
Organizational  Factors  level  (upper  management)  usually  presides  over  personnel  selection  in 
terms  of  hiring  and  firing  by  developing  job  descriptions  and  qualifications  requirements.  A 
company  which  takes  the  quality  of  its  personnel  seriously  can  do  much  to  ensure  the  right 
people  are  placed  in  the  right  jobs.  The  Supervision  layer  of  system  defenses  also  contributes 
significantly  in  terms  of  the  way  personnel  are  assigned  to  tasks.  Again,  if  the  supervisor  takes 
this  job  seriously,  the  right  numbers  of  people,  fit  for  duty,  and  with  the  right  qualifications  can 
be  assigned  to  operational  and  maintenance  duties,  helping  to  ensure  safety. 

7.2.5  Training  and  Standard  Operating  Procedures  (SOPs) 

Training  and  SOPs  make  up  the  next  element  in  the  triangle^"^.  “More  training”  has  too  often 
been  management’s  sole,  knee-jerk  remedy  to  incidents.  As  already  stated,  more  training  can 
not  make  up  for  inattention  given  to  other  barriers  such  as  workplace  design,  environmental 
control,  and  management  policies.  Another  frequent  limitation  to  training  is  that  it  is  assumed 
that  someone  who  is  experienced  at  a  given  task  is  therefore  qualified  to  train  others.  Such 
training  is  haphazard,  often  poorly  performed,  and  usually  incomplete.  There  are  rigorous 
methods  (such  as  Instructional  Systems  Development)  for  analyzing  tasks,  determining 
performance  objectives,  and  training  and  testing  to  these  objectives  (McCallum,  Forsythe, 
Smith,  Nunnenkamp  &  Sandberg,  2001).  As  automated  systems  become  more  prevalent  in  the 
maritime  and  offshore  industries,  thorough  training,  not  just  in  the  task  at  hand,  but  also  in  the 
operational  parameters  of  the  equipment,  becomes  increasingly  necessary  (Sanquist,  et  al., 
1996).  In  summary,  before  resorting  to  training,  make  sure  it  really  is  the  answer  to  the 
problem;  and  if  training  is  what’s  needed,  then  it’s  worth  doing  right. 

The  second  part  of  this  element  is  standard  operating  procedures.  Many  times  incidents  occur 
not  because  the  worker  lacked  skills  or  knowledge,  but  because  the  SOP  was  not  designed 
appropriately  for  the  given  conditions.  The  Training/SOP  element  acts  as  a  safety  intervention 
in  all  three  layers  of  system  defenses  (Fig.  20).  At  the  Organizational  Factors  layer,  the 
responsibility  is  to  institute  sufficient  training  and  effective,  safe  SOPs.  At  the  Supervision  layer, 
the  training/SOP  defense  is  to  ensure  trained  personnel  are  assigned  to  tasks  and  that  they  use 
the  SOPs.  At  the  Preconditions  layer,  the  worker  must  ensure  that  he/she  has  the  required 
training  to  do  assigned  work  and  that  he/she  understands  and  consistently  uses  SOPs.  While 
all  three  layers  of  system  defense  are  necessary  to  ensure  safe  operations,  it  is  clear  that  a 
“hole”  in  the  Organizational  Factors  layer  (e.g.,  a  decision  to  provide  only  the  most  basic 
training/SOPs,  or  to  shirk  the  responsibility  and  place  it  wholly  on  supervision’s  shoulders)  will 
do  the  most  harm,  since  that  “missing  barrier”  will  affect  the  entire  workforce. 


Miller  refers  to  this  element  just  as  “training”.  However,  a  recent  study  (McCallum,  Forsythe,  et  al., 
2000)  notes  that  many  incidents  attributed  to  inadequate  knowledge  and  skills  are  actually  promoted 
through  incorrect  SOPs,  as  opposed  to  insufficient  training,  per  se. 
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A  final  note  on  standard  operating  procedures.  Many  of  them  are  written  so  poorly  that 
personnel  are  unable  to  use  SOPs  effectively.  SOPs  are  important  for  safe  operation,  and  they 
should  be  well-written  in  order  to  convey  the  needed  information  to  the  users.  A  good  tutorial  on 
writing  SOPs  is  given  by  Information  Mapping^^. 

7.2.6  Interpersonal  Relationships  (Communication) 

Interpersonal  relationships  (communication)  is  what  makes  teams  work.  Offshore,  shipboard, 
and  dockside  activities  all  depend  on  teamwork.  In  earlier  times,  the  Offshore  Installation 
Manager  or  the  ship’s  Master  was  the  unquestioned  authority  in  a  one-way,  top-down,  chain  of 
command  (Miller,  2000).  However,  most  shipping  and  offshore  companies  (and  many  other 
industries,  such  as  aviation  and  nuclear  power)  have  recognized  that  “crew  resource 
management”  is  an  essential  component  of  safety.  Personnel  need  to  feel  empowered  to  speak 
up,  question,  and  double-check  decisions  and  actions  of  other  team  members  (including 
supervisors).  Research  has  shown  that  when  crew  members  do  not  communicate  effectively, 
accidents  result:  28%  of  personnel  injuries  and  18%  of  vessel  casualties  were  related  to 
inadequate  communications  (McCallum,  Raby,  Rothblum,  Forsythe,  Slavish  &  Smith,  2000, 
unpublished). 

In  the  maritime  and  offshore  environments,  poor  communications  can  be  caused  by  factors  in 
addition  to  a  lack  of  crew  resource  management.  Physical  constraints  (separating  persons  who 
need  to  be  together  via  poor  layout  of  rooms  or  facilities),  inappropriate  organizational  structure 
which  puts  too  many  chains  of  command  between  individuals  who  need  to  communicate,  and 
overloading  workers  so  that  they  do  not  have  the  time  to  communicate  can  all  contribute  to  poor 
interpersonal  communications.  This  is  a  factor  that  is  often,  and  mistakenly,  overlooked  in 
incident  investigations. 

Good  communication  is  a  safety  intervention  that  must  be  established  at  all  three  layers  of 
system  defense.  As  was  the  case  with  Training/SOPs,  the  Organizational  Factors  layer  must 
lay  the  foundation  by  making  two-way  communication  a  part  of  company  culture  and  facilitate  it 
through  good  workplace  design  and  policies.  Supervisors  must  actively  support  and  encourage 
effective  communications  within  and  among  teams.  And  to  keep  communications  from 
becoming  a  Precondition  for  Unsafe  Acts,  workers  need  to  be  involved,  responsive  members  of 
their  work  teams. 


For  more  information  about  seminars  by  Information  Mapping,  please  see  their  web  site  at 
http://www.infomap.com  or  call  (800)  INFO  MAP  (463-6627). 
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7.2.7  Job  Aids 

Job  aids  come  in  several  forms  such  as  hazard  identification  (warning)  signs,  operator  and 
maintainer  manuals,  and  specific  operating  procedures.  These  can  be  of  help  in  reducing 
human-induced  incidents,  especially  when  learning  a  new  task,  performing  a  task  that  is  done 
infrequently,  or  completing  a  job  that  must  be  performed  in  an  exact  sequence.  However,  a 
poorly  prepared  job  aid  can  lead  to  incidents  rather  than  prevent  them.  Examples  of  critically 
important  job  aids  found  on  ships  and  platforms  are  the  lifeboat  launching  instructions  and  the 
operating  instructions  for  manually  releasing  the  fire  fighting  suppressant  system.  Unfortunately, 
these  safety-critical  instructions  are  typically  confusing  and  difficult  to  understand  (Miller,  2000). 

There  is  a  lot  of  research  available  on  how  to  prepare  good  job  aids,  instructional  placards,  and 
warning  signs  (Curole,  McCafferty  &  McKinney,  1999;  Laughery,  Wogalter  &  Young,  1994; 
Wogalter,  Young  &  Laughery,  2001;  and  seminars  by  Information  Mapping^^).  One  concept, 
called  information  mapping  (Curole,  et  al.,  1999),  utilizes  research  on  the  human  learning 
process  to  provide  very  specific  guidelines  on  how  to  prepare  manuals,  procedures,  checklists 
and  other  printed  and-or  pictorial  job  aids.  Properly  prepared  job  aids  can  be  a  useful  barrier  to 
the  prevention  of  maritime  incidents.  By  the  same  token,  poorly-written  or  missing  job  aids  can 
contribute  to  incidents  and  are  an  important  aspect  to  be  considered  both  during  the  incident 
investigation  and  in  the  preparation  of  preventive  recommendations. 

7.2.8  Fitness  for  Duty 

Fitness  for  duty  is  another  term  for  adverse  mental  or  physiological  states  that  are  severe 
enough  to  reduce  the  individual’s  capacity  to  perform.  These  states  can  be  due  to  physiological 
conditions  of  illness  or  fatigue,  or  to  the  use  of  alcohol  or  drugs  (including  over-the-counter 
medications).  These  states  can  also  be  psychological  in  nature  such  as  emotional  trauma  due 
to  family  or  financial  problems,  or  from  a  neurotic  or  even  psychotic  disorder.  If  any  of  these 
things  is  sufficient  to  distract  or  otherwise  impact  the  person’s  performance  of  safety-related 
duties,  it  can  be  a  definite  contributor  to  an  incident.  This  is  another  factor  that  is  often 
overlooked  during  the  incident  investigation  process,  but  should  receive  attention. 

Essentially,  fitness  for  duty  is  the  responsibility  of  the  worker  to  keep  it  from  becoming  a 
precondition.  Line  supervisors  have  a  responsibility  to  ensure  that  workers  are,  in  fact,  fit  for 
duty.  This  is  the  one  element  of  the  triangle  that  the  Organizational  Factors  layer  doesn’t 
explicitly  address  (for  example,  work-rest  policies  and  worksite  environment,  both  of  which  can 
affect  an  employee’s  physiological  and  mental  fitness  for  duty,  would  fall  under  other  triangle 
elements). 

Fitness-for-duty  testing  is  a  controversial  area.  There  are  some  tests  available  for  determining 
whether  a  person  is  under  the  influence  of  drugs  or  alcohol  or  severely  fatigued;  however,  the 
reliability  of  most  of  these  tests  is  a  hotly-debated  issue.  Some  trucking  companies  have 
successfully  used  a  simulator-type  test  to  ensure  a  trucker’s  driving  performance  is  up  to  par 
before  getting  on  the  road.  Such  scientifically-validated  and  operationally-relevant  screening 
techniques  have  yet  to  be  developed  for  the  maritime  and  offshore  industries. 
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An  alternative  approach  to  testing  is  to  implement  a  crew  endurance  program  (Comperatore, 
Rothblum,  Kingsley,  Rivera,  &  Carvalhais,  2001).  This  type  of  program  educates  personnel  as 
to  how  fitness  for  duty  can  affect  not  only  job  performance  but  long-term  health  and  assists 
personnel  in  controlling  the  hazards  that  affect  fitness  for  duty  (note  that  such  a  program  would 
be  part  of  the  Policies  &  Culture  and  Training/SOP  elements  of  the  triangle,  not  the  Fitness  for 
Duty  element).  Since  many  of  the  variables  that  influence  fitness  for  duty  are  job-related  (e.g., 
fatigue  from  poorly  designed  work  schedules,  or  lack  of  coordination  and  manual  dexterity  from 
working  in  too-cold  temperatures),  a  crew  endurance  program  helps  to  prevent  latent  factors  at 
all  three  layers:  organizational  factors,  supervision,  and  preconditions  for  unsafe  acts. 

To  summarize,  the  precursor  for  effective  safety  solutions  is  an  in-depth  analysis  of  incidents. 
Only  by  understanding  all  the  latent  factors  which  contributed  to  an  incident  can  one  determine 
what  “barriers”  would  be  effective  in  either  averting  or  reducing  the  effects  of  similar  incidents  in 
the  future.  It  is  helpful  to  establish  “barriers”  or  interventions  within  all  layers  of  system 
defenses  in  order  to  reduce  the  likelihood  of  future  incidents.  However,  when  this  is  not 
feasible,  try  to  implement  interventions  in  the  areas  of  policies  &  culture,  workplace  design,  and 
environmental  control,  as  these  are  often  latent  factors  for  many  incidents  and  are  usually  more 
effective  at  preventing  incidents  than  interventions  towards  the  tip  of  the  triangle  of 
effectiveness.  One  last  key  to  successful  interventions:  make  your  safety  interventions 
“SMART”;  that  is,  they  should  be  specific,  measurable,  mtainable,  reasonable,  and  timely. 


8.0  User  Experiences  with  Starting  an  Incident  Investigation  Program 

This  section  provides  two  examples  of  agencies  which  have  begun  to  incorporate  human 
factors  incident  investigations.  Their  experiences  demonstrate  how  human  factors  incident 
investigation  is  used  and  provide  some  “lessons  learned”. 

8.1  U.K.  Marine  Accident  Investigation  Branch 

8.1.1  Background 

The  Marine  Accident  Investigation  Branch  (MAIB)  is  an  independent  division  of  the  United 
Kingdom’s  Department  for  Transport,  Local  Government  and  the  Regions  (DTLR).  The  chief 
inspector  reports  directly  to  the  Secretary  of  State,  and  is  empowered  to  investigate  marine 
accidents  and  hazardous  incidents  occurring  onboard  or  to  UK  registered  ships  worldwide,  and 
to  all  other  vessels  within  UK  territorial  waters.  Each  year  MAIB  receives  over  2,000  incidents. 
Presently,  about  60  field  investigations  are  undertaken  annually  by  13  inspectors  working 
individually  or  as  a  team.  Such  field  investigations,  including  the  formal  report  produced,  take 
about  10-12  months.  MAIB  inspectors  also  investigate  about  550  additional  incidents  by  paper 
and  telephone. 

The  fundamental  purpose  of  an  MAIB  investigation  is  to  determine  the  circumstances  and 
causes  of  an  accident  or  incident  with  the  aim  of  improving  the  safety  of  life  at  sea  and  the 
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avoidance  of  accidents  in  the  future.  It  is  notthe  purpose  to  apportion  liability  nor  to  apportion 
blame:  MAIB  is  not  an  enforcing  authority;  that  role  is  taken  by  the  Maritime  and  Coastguard 
Agency,  a  totally  separate  organization  within  the  DTLR.  An  MAIB  investigation  is  conducted  in 
accordance  with  the  provisions  of  The  UK  Merchant  Shipping  (Accident  Reporting  and 
Investigation)  Regulations  1999,  and  aims  to  determine:  what  happened;  how  it  happened;  why 
it  happened;  and  what  can  be  done  to  prevent  it  from  happening  again. 

8.1.2  Events  Leading  to  Human  Factors  Investigations 

In  the  1980’s  the  Surveyor  General  Organization  (predecessor  of  the  Maritime  and  Coastguard 
Agency)  commissioned  the  Tavistock  Institute  of  Human  Relations,  London,  to  carry  out  a 
series  of  studies  on  the  human  element  in  shipping  casualties.  This  was  done  in  order  to 
understand,  and  hence  reduce,  the  dangers  associated  with  human  frailty  in  the  United 
Kingdom  merchant  fleet.  This  was  the  first  systematic  attempt  to  consider  human  error  in 
shipping  casualties  in  the  UK.  Some  of  the  recommendations  from  the  study  were  that: 

•  More  attention  should  be  paid  to  the  structure,  order,  and  timing  of  questions  in 
accident  investigation. 

•  A  check-list  of  human  element  questions  should  be  developed  to  help  the 
investigator  in  relating  his  thoughts  to  the  general  body  of  human  factors  knowledge. 

•  A  search  for  alternative  explanations  to  accidents  should  be  consciously  developed. 
This  would  discourage  a  pre-occupation  with  finding  a  single  best  explanation,  which 
may  be  counterproductive  to  revealing  the  true  facts  about  specific  casualties. 

•  Regular  seminars  should  be  conducted  to  exchange  experiences  about  casualty 
investigation. 

•  A  computerized  and  flexible  accident  data  system  should  be  developed  to  aid  human 
factors  research. 

MAIB  was  set  up  as  a  separate  organization  in  July  1989.  It  was  chartered  to  investigate 
accidents,  keeping  this  function  separate  from  the  Maritime  and  Coastguard  Agency’s 
responsibility  for  the  regulation  of  ship  safety. 

8.1.3  MAIB’s  Classification  of  Human  Factors  Causes 

MAIB  began  with  a  relatively  simple  taxonomy  of  human  factors,  looking  mainly  at  operator  error 
and  organizational  factors.  In  1994,  MAIB  developed  a  more  comprehensive  classification  of 
human  factors  contributions  to  accidents  and  incidents.  Based  on  Reason’s  model  of  accident 
causation,  the  classification  developed  aimed  to  show  how  active  human  errors  or  violations  are 
shaped  by  latent  failures.  MAIB  currently  has  six  top-level  human  factors  classifications: 

•  External  bodies  liaison  (e.g.,  regulations) 

•  Company  &  organization 
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•  Crew  factors 

•  Equipment 

•  Working  environment 

•  Individual 

There  are  sub-classifications  under  each  of  these  headings  (see  Appendix  D  for  the  full 
taxonomy).  The  database  was  designed  to  encourage  the  examination  of  accident  context 
either  from  the  individual  outwards  to  the  regulatory  and  policy  context,  or  from  the  context  and 
company  inwards  to  the  vessel  and  the  individuals  who  operate  it.  In  this  way,  MAIB  increases 
the  likelihood  of  identifying  contributing  factors  at  all  levels.  Some  of  these  levels  may  be 
related:  for  example,  company  policy  on  training  may  influence  skills  and  knowledge  at  an 
individual  level.  In  many  cases,  there  will  be  unrelated  human  factors  areas  which  contribute  to 
an  accident.  All  the  human  factors  causes  which  can  be  identified  from  the  evidence  available 
should  be  classified. 

8.1.4  Human  Factors  Training  for  MAIB  Inspectors 

The  development  of  inspector  skills  and  understanding  of  human  factors  investigation  has  been 
an  evolutionary  process.  The  thirteen  MAIB  inspectors  work  under  one  roof  in  Southampton 
which  provides  an  ideal  opportunity  to  share  with  each  other,  on  a  daily  basis,  experiences  with 
accident  investigation.  Initially,  MAIB  inspectors  attended  human  factors  training  courses 
provided  by  the  Transportation  Safety  Board  of  Canada  and  by  Det  Norske  Veritas  (DNV)  in 
Atlanta.  Inspectors  were  encouraged  to  attend  seminars  and  lectures  on  human  factors. 

This  was  an  ad-hoc,  but  to  some  extent  effective,  approach  to  introducing  a  more  formal 
method  of  human  factors  investigation.  However,  a  significant  drawback  was  the  difference  in 
terminology  used  by  the  varying  sources  of  training  and  guidance.  This  hindered  investigation 
team  effectiveness  and  made  quality  assurance  of  the  investigation  process  and  reporting 
difficult  and  inconsistent. 

To  enable  a  common  understanding  of  human  factors  investigation,  an  MAIB  training  course 
was  developed  to  achieve  a  more  consistent  and  reliable  approach  by  inspectors  to  evaluate 
the  human  factors  causes  of  accidents.  A  certain  amount  of  consistency  of  reporting  and  data 
input  has  been  achieved,  but  inconsistency  and  occasional  confusion  does  sometimes  arise. 
MAIB  tries  to  overcome  these  problems  by  internal  seminars  on  human  factors,  regular  reviews 
and  audits  of  the  investigation  process  and  outcomes,  and  attendance  of  the  MAIB  course.  The 
course  content  adapts  to  the  changing  needs  and  experience  of  the  inspectors. 

The  most  recent  MAIB  course  lasted  two  days  and  included  topics  such  as:  a  general 
introduction  to  human  factors  (human  performance,  teamwork,  basic  methods,  terms,  and 
tools);  human  factors  and  accident  investigation,  including  models  of  causation;  human  error 
and  error  analysis  (such  as,  what  is  human  error,  why  does  it  occur,  how  is  it  assessed. 
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performance  influencing  factors,  the  SHEL  model,  preventing  errors  and  violations  and 
minimizing  the  impact  of  errors,  safety  management,  and  safety  culture). 

A  formal  approach  to  human  factors  investigation  has  also  highlighted  the  importance  of 
effective  interviewing  techniques.  Consequently,  attendance  by  all  inspectors  on  an  in-house 
interviewing  techniques  course  run  by  an  experienced  trainer  is  mandatory.  Continuous 
development  of  inspector  competence  in  human  factors  investigation  is  also  promoted  through 
mini-coaching  sessions,  self-study,  and  the  day-to-day  application  of  MAIB’s  formal 
investigation  process.  As  a  result,  MAIB  now  has  a  team  of  inspectors  competent  in  the 
investigation  and  identification  of  human  factors  contributors  to  marine  casualties. 

8.1.5  Benefits  of  MAIB’s  Database 

More  than  1 ,000  accidents  investigated  by  MAIB  inspectors  are  recorded  in  the  database.  A 
measure  of  success  of  the  database  is  the  increasing  demand  from  diverse  interests  in  the 
marine  industry.  Excluding  MAIB,  the  main  users  of  the  database  are  the  Maritime  and 
Coastguard  Agency  (MCA),  university  researchers,  and  consultants,  all  seeking  patterns  and 
trends  in  accident  types  and  causes.  Information  in  the  database  has  been  particularly  helpful 
to  the  MCA  who,  along  with  other  flag  states,  is  introducing  codes  of  operational  inspections 
and  risk  assessments  and  certificates  of  competency  based  on  performance  standards. 

The  historical  information  from  similar  accidents  has  also  proven  to  be  a  powerful  tool  to 
promote  MAIB  arguments  for  safety  changes.  For  example,  MAIB  analysis  has  uncovered 
trends  in  accidents  during  lifeboat  launching  and  recovery  caused  by  a  multiplicity  of  human 
factors.  The  study  was  able  to  identify  common  factors  leading  to  these  accidents,  and  the 
risks  associated  with  lifeboat  launching  systems,  by  examining  the  common  problems 
encountered.  Operators  make  mistakes  in  maintenance  and  operation  of  launching  equipment 
because  of  overly  complex  design  and  inadequate  operator  manuals.  Over  the  years,  the  size 
and  weight  of  lifeboats  and  equipment  have  increased,  diminishing  the  ability  of  seamen  to 
handle  launching  and  recovery  operations  safely.  The  database  analyses  have  allowed  MAIB 
to  understand  the  problems  and  to  make  safety  recommendations. 

8.2  California  State  Lands  Commission,  Marine  Facilities  Division 

8.2.1  Background 

The  Marine  Facilities  Division  (MFD)  of  the  California  State  Lands  Commission  is 
headquartered  in  Long  Beach,  California.  Created  in  1990,  the  MFD  is  tasked  with  pollution 
prevention  at  marine  oil  terminals.  Towards  this  end,  MFD  inspectors  monitor  activities  and 
enforce  regulations  at  85  marine  facilities  along  the  California  coast.  Inspectors  oversee  and 
evaluate  the  safety  of  such  operations  as  oil  transfers  to  and  from  oil  tankers  and  barges  and 
make  comprehensive  inspections  of  marine  oil  terminals  and  pipelines.  At  a  Facility’s  request. 
Division  Specialists  also  conduct  safety  management  assessments  aimed  at  identifying 
potential  trouble  areas  in  an  organization’s  defenses  against  adverse  incidents. 
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8.2.2  Initiation  of  Human  Factors  Investigations 

MFD  specialists  and  inspectors  also  investigate  oil  spills  as  a  means  of  informing  prevention 
strategies.  Up  until  recently,  those  inquiries  identified  personnel,  organizational,  and  equipment 
factors  as  primary  or  secondary  causes  of  spills,  but  without  clearly  distinguishing  active  failures 
from  latent  system  conditions.  Additionally,  it  was  difficult  to  capture  within  the  investigation 
framework  the  multiple  factors  that  often  conspired  to  bring  about  a  single  adverse  event.  In 
May  of  2001,  MFD  introduced  its  inspectors  to  the  Fluman  Factors  Analysis  and  Classification 
System  (FIFACS;  Wiegmann  &  Shappell,  1999)  and  has  begun  using  that  model  to  support 
inquiries  and  to  analyze  system  failures  that  contribute  to  spills.  The  FIFACS  taxonomy  was 
selected  in  part  because  it  is  particularly  well-suited  for  prevention,  in  that  it  encourages  a  focus 
on  failed  system  defenses,  rather  than  on  individual  failures.  This  allows  users  of  the  resulting 
data  to  address  the  appropriate  system  components  in  devising  prevention  strategies. 

8.2.3  Adaptations  to  FIFACS 

It  was  initially  clear  that  MFD  needed  to  extend  the  tool  to  cover  certain  structural  and 
mechanical  faults  as  well  as  environmental  conditions  in  order  to  cover  the  spectrum  of 
contributors  to  oil  spills.  Note  that  this  is  not  a  deficiency  on  the  part  of  FIFACS:  FIFACS  was 
intended  to  guide  the  human  factors  portion  of  an  investigation.  Naturally,  there  will  be 
equipment  factors,  weather  factors,  and  other  non-human  factors  that  contribute  to  many 
casualties  and  incidents.  It  will  be  necessary  for  any  company  to  develop  its  own  set  of 
classifications  to  capture  these  types  of  problems.  Flowever,  MFD  observed  that  most  of  the 
contributing  factors  to  oil  spills  were,  in  fact,  human  factors,  so  they  found  it  handy  to  use 
FIFACS  as  their  main  classification  tool  and  add  the  equipment  and  environmental  factors  to  it. 

Their  complete  investigation  taxonomy  is  shown  in  Appendix  E  (see  “FIFACS  Layer  Guides”). 
Equipment  factors  were  appended  to  the  Layer  1  Guide  (Unsafe  Acts  from  FIFACS)  as 
“Structural/Mechanical  Damage/Failure”.  This  is  the  equipment  analog  of  an  unsafe  act,  in  that 
the  damage  or  failure  appears  as  the  immediate  cause  of  an  incident  (e.g.,  the  oil  spill  appeared 
to  be  caused  by  a  damaged  valve).  Similarly,  equipment  and  environmental  factors  were  added 
to  the  Preconditions  layer  (Layer  2).  Just  as  “complacency”  is  an  adverse  mental  state 
(precondition)  that  can  lead  to  a  routine  violation  (unsafe  act)  like  taking  a  shortcut  that  causes 
an  incident,  substandard  equipment  design,  such  as  an  ambiguous  display,  can  be  the 
precondition  for  an  unsafe  act  (misreading  the  display  and  causing  an  incident).  In  this  way, 
MFD  combined  the  major  oil  spill  causal  factors  -  both  human  and  non-human  -  into  a  single, 
FIFACS-like  taxonomy. 

Adaptations  were  made  to  the  human  factors  taxonomy  as  well.  FIFACS  was  originally 
developed  for  aircraft  accidents,  and  thus  incorporates  certain  terminology  and  causal  factors 
related  to  aviation  (such  as  “hypoxia”  and  “spatial  disorientation”).  These  terms  were  dropped. 
Maritime  industry  specific  terms  are  captured  using  event  data  forms,  which  require  an  incident 
specific  statement  of  the  actor  (an  individual  or  group,  or  a  structure/part)  and  a  Situation- 
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specific  description  of  the  action/inaction  or  system  failure  that  contributed  to  the  incident.  This 
remains  an  ongoing  process. 

8.2.4  Training  and  Job  Aids 

HFACS  was  introduced  to  MFD  when  their  human  factors  analyst  took  a  full-day  workshop  on 
the  topic  led  by  Drs.  Wiegmann  and  Shappell.  Fie  then  developed  and  provided  training  on 
FIFACS  to  MFD’s  inspectors  and  specialists.  Discussions  among  MFD  staff  occur  during 
monthly  meetings,  and  along  with  input  from  other  maritime  industry  representatives,  these 
meetings  led  to  modifications  in  the  taxonomy  (discussed  above)  and  to  the  development  of  job 
aids.  The  job  aids  used  by  MFD  inspectors  are  provided  in  Appendix  E. 

New  job  aids  and  revisions  of  existing  ones  are  considered  regularly  in  response  to  issues  that 
arise  during  monthly  meetings.  Situation-specific  guidance  sheets  are  presently  under 
development  to  guide  team  members  in  collecting  essential  information  in  response  to 
particular  circumstances.  Guidance  is  in  a  bulleted  “If  -  then”  form.  For  example. 

If  the  incident  involves  turning  an  incorrect  vaive, 

Then 

•  photograph  the  valve  and  its  immediate  area; 

•  ask  about  a  history  of  such  incidents; 

•  ask  whether  the  involved  personnel  were  experienced  with  the  equipment; 

•  detail  communications  leading  up  to  the  action. 

The  intention  of  these  sheets  is  to  assure  that  relevant  data  are  collected  before  they  are  lost. 

8.2.5  Benefits  of  Fluman  Factors  Investigations 

MFD  is  less  than  a  year  into  using  the  revised  FIFACS  investigation  tool,  and  is  still  learning 
about  the  process  and  making  changes  to  its  procedures.  Flowever,  an  early  analysis  of  six 
incidents  shows  that  inspectors  are  learning  to  use  the  tool.  Of  the  21  causal  factors  identified, 
20  could  be  completely  categorized  by  the  inquiry  team  -  which  included  marine  safety 
inspectors,  specialists  and  a  human  factors  analyst  -  using  FIFACS. 

Not  surprisingly,  inquiry  teams  were  more  successful  at  identifying  unsafe  acts  and 
preconditions  than  they  were  at  finding  problems  in  other  latent  factors  like  unsafe  supervision 
and  organizational  influences.  Team  members  felt  that  they  had  sufficiently  considered  and 
identified  all  relevant  unsafe  acts  in  five  (of  the  six)  incidents,  and  had  identified  all  the 
preconditions  in  four  of  the  incidents.  Flowever,  teams  judged  that  they  had  identified  all  the 
potential  types  of  unsafe  supervision  in  only  three  of  the  incidents,  and  had  identified  all  the 
organizational  factors  in  only  one  incident. 

There  are  five  issues  that  may  contribute  to  the  difficulty  of  identifying  latent  factors.  The  first  is 
that  it  can  take  substantial  time  and  resources  (on  the  parts  of  both  the  investigator  and  those 
being  investigated)  to  dig  beneath  the  surface  and  unearth  latent  factors.  Sufficient  time  is  not 
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always  available.  Second,  when  a  regulatory  body  (such  as  MFD)  or  an  employer  is  also  the 
investigator,  the  fear  of  punishment  can  be  a  disincentive  for  those  under  investigation  to  fully 
cooperate  and  help  identify  latent  factors.  Third,  necessary  information  may  be  unavailable, 
either  because  it  is  confidential  (e.g.,  personnel  records)  or  unrecoverable  (e.g.,  a  momentary 
state  of  mind,  an  absent  maintenance  record).  Fourth,  organizational  influences  in  particular 
sometimes  only  become  apparent  over  the  course  of  several  incidents  rather  than  in  a  single 
one.  Team  members  have  addressed  this  through  incorporating  a  structured  note  rather  than 
assigning  a  contributing  factor  when  they  have  reason  to  believe  -  but  not  definitive  evidence  - 
that  an  organizational  factor  is  among  weakened  defenses  in  a  particular  case.  Finally,  those 
conducting  the  inquiry  may  lack  the  know-how  or  experience  to  ask  the  appropriate  questions. 
This  can  occur  for  those  with  considerable  maritime  knowledge  as  well  as  those  with  human 
factors  knowledge,  since  for  any  one  investigator  that  knowledge  is  likely  to  be  centered  around 
particular  areas  (ship,  terminal,  company  operations,  or  management),  and  their  ability  to 
establish  a  comfortable  rapport  with  key  individuals  related  to  the  incident  will  vary  accordingly. 

While  there  are  too  few  cases  yet  to  allow  for  meaningful  analysis,  there  have  already  been 
“lessons  learned”  that  can  help  commercial  companies  improve  safety.  MFD  is  starting  a 
newsletter  as  a  way  of  sharing  this  information  with  the  marine  terminal  companies.  Another 
benefit  from  these  initial  uses  of  FIFACS  has  been  the  discovery  of  an  area  in  which  MFD  can 
improve  its  reviews  of  preventative  maintenance  programs.  Additionally,  notes  have  been 
expanded  to  capture  instances  when  “outside  influences”  -  factors  other  than  terminal  and 
vessel  organizations  -  contribute  to  incidents.  In  summary,  MFD’s  human  factors  incident 
investigation  program  has  gotten  off  to  a  good  start  and  shows  promise  in  discovering  how 
marine  terminals  can  change  their  policies  and  operations  to  improve  safety  and  reduce  oil 
spills. 

8.3  Stolt-Nielsen  Transportation  Group 

8.3.1  Background 

Stolt-Nielsen  S.A.  is  one  of  the  world’s  leading  providers  of  transportation  services  for  bulk 
liquid  chemicals,  edible  oils,  acids,  and  other  specialty  liquids.  The  company,  through  its  parcel 
tanker,  tank  container,  terminal,  rail  and  barge  services,  provides  integrated  transportation  for 
its  customers.  Stolt-Nielsen  Transportation  Group  owns  72  ships  involved  in  the  chemical 
parcel  trade:  51  ships  in  world-wide  trade  and  21  ships  in  coastal  trade  in  Europe  and  the  Far 
East. 

Stolt-Nielsen  has  developed  a  full  International  Ship  Management  (ISM)  Quality  and  Safety 
Program  for  its  ships.  This  program  is  to  the  highest  standards  of  the  industry  and  is  audited  by 
three  classification  societies.  The  safety  program  tracks  and  investigates  all  incidents  and  uses 
statistical  process  control  methods  to  identify  trends.  In  turn,  this  information  is  used  to  develop 
training  and  educational  programs  designed  to  reduce  risks  and  losses.  As  an  industry  leader. 
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Stolt-Nielsen  also  shares  its  data  and  benchmarks  with  other  companies  through  groups  such 
as  the  National  Safety  Council^®. 

8.3.2  Human  Factors  Incident  Investigation 

Stolt-Nielsen  has  been  doing  incident  investigation  for  a  number  of  years.  Since  it  already  had 
an  ongoing  training  and  Quality  Assurance  program,  the  incident  investigation  program  was 
added  under  the  same  umbrella  at  minimal  cost  to  the  company.  In  1992,  a  human  factors 
investigation  taxonomy  was  added.  Stolt’s  investigation  form  (see  App.  F),  while  simpler  than 
those  used  by  MAIB  and  MFD,  has  nevertheless  proven  to  help  the  company  detect  and  correct 
a  variety  of  safety  hazards. 

Incident  investigation  is  a  combined  responsibility  of  ships’  officers  and  of  Stolt’s  Division  of 
Marine  and  Safety  Services.  Officers  are  trained  on  incident  investigation,  and  other  Quality 
Assurance  topics,  every  three  years.  Because  Stolt’s  officers  and  crew  are  from  around  the 
world,  training  is  an  expensive  undertaking.  All  incident  forms  are  sent  to  the  Assistant 
Manager  of  Marine  and  Safety  Services,  who  completes  the  investigation.  By  having  a  single 
person  ultimately  responsible  for  the  incident  data  helps  to  keep  the  data  reliable  (consistent 
use  of  terms  and  coding).  The  major  problem  with  investigating  incidents  is  that  the  fleet  is 
distributed  worldwide,  making  timely  and  accurate  reporting  a  challenge.  However,  persistence 
on  the  part  of  the  investigator  and  a  shared  understanding  of  the  importance  of  the  incident 
program  has  led  to  a  successful  program. 

The  Assistant  Manager  is  also  responsible  for  the  data  analysis,  which  is  a  “plus”,  since  the 
analyst  knows  the  terminology  and  understands  the  constraints  under  which  the  data  were 
collected,  which  in  turn  reduces  the  likelihood  that  unwarranted  data  comparisons  will  be  made. 
Stolt  analyzes  their  incident  data  quarterly,  looking  both  for  trends  within  the  company  and 
benchmarking  their  incident  rates  against  those  of  other  shippers  that  are  members  of  the 
National  Safety  Council.  “Lessons  learned”  from  incident  analyses  are  disseminated  widely 
through  the  company  via  Loss  Control  Bulletins  and  training  programs. 

8.3.3  Benefits  of  the  Incident  Database 

Stolt  enjoys  a  lower  incident  rate  than  the  industry  average  (Fig.  21),  due  in  large  part  to  its 
attentive  tracking  of  incidents  and  responsive  safety  interventions.  Stolt  uses  frequency 
analysis  and  analyzes  trends  over  years  to  identify  safety  problems  and  track  the  success  of  its 
interventions.  As  described  in  the  Analysis  section,  Stolt  had  used  incidents  to  determine  that 
crew  members  suffered  a  high  frequency  of  slips,  trips,  and  falls.  In  response,  the  company 
acquired  new  safety  shoes  designed  for  better  traction  on  wet  surfaces.  Follow-up  statistics 


The  Waterborne  Transport  Division  of  the  Nationai  Safety  Councii  currentiy  keeps  safety  data  that 
members  can  use  for  benchmarking.  There  are  pians  to  produce  guidance  and  training  to  heip 
members  improve  their  safety  anaiysis  and  benchmarking  capabiiities.  For  more  information,  piease  see 
their  website  at  http://www.waterbornetransport.com  or  contact  Wiiiiam  Boehm  by  phone  at  (281)  860- 
5043  or  by  emaii  at  wboehm(5)stoit.com  . 
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Lost  Time  Injury  Rates  (Industry  vs.  Stolt) 


1992  1993  1994  1995  1996  1997  1998  1999  2000 


Figure  21 .  Comparison  of  Lost  Time  Injury  Rates  between  Stolt 
and  an  Industry  Average  from  1992  through  2000 

This  is  an  example  of  how  Stolt  uses  incident  data  to  benchmark 
its  safety  relative  to  other  companies.  (Data  courtesy  of  Stolt- 
Nielsen  Transportation  Group.) 


revealed  a  marked  decrease  in  slips,  trips,  and  falls,  which  appear  to  show  the  success  of  the 
intervention. 

Another  use  of  incident  data  is  shown  in  Figure  22,  which  depicts  a  comparison  of  the 
frequencies  of  various  types  of  injuries  (data  for  the  first  three  quarters  of  2001).  As  can  be 
seen  in  the  graph,  injuries  to  the  head  and  eyes  happened  most  frequently,  and  these  findings 
were  supported  by  data  from  prior  years.  Thus,  Stolt  has  reviewed  the  types  of  safety  glasses 
and  hardhats  used  by  crew  members  and  have  identified  problems  with  the  current  safety 
equipment.  An  alternate  type  of  safety  glasses  is  now  being  tried  which  hopefully  will  provide 
better  protection.  Regarding  hardhats,  one  of  the  problems  discovered  was  that  current 
hardhats  were  uncomfortable,  and  crew  members  did  not  wear  them  consistently.  A  new  type 
of  head  protection  -  a  ball  cap  with  a  “butcher’s  hard  cap”  inserted  inside  -  is  being  trialed  as  a 
result. 
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Analysis  of  Body  Parts  Injured 
(1001-3001) 


Figure  22.  Number  of  Incidents  as  a  Function  of  Body  Part  Injured. 

(Data  from  first  three  quarters  of  2001 ;  courtesy  of  Stolt- 
Nielsen  Transportation  Group.)  This  shows  how  Stolt  uses 
incident  data  to  identify  safety  hazards. 


Stolt  regards  its  incident  investigation  program  to  be  a  resounding  success.  By  using  incident 
investigation  as  a  part  of  its  overall  Quality  Assurance  program,  Stolt  has  been  able  to  identify 
and  correct  safety  problems,  many  of  which  have  human  factors  causes.  Through  a  consistent 
focus  on  incident  causes  and  efforts  to  remediate  those  causes,  Stolt  has  achieved  lower  injury, 
accident,  and  pollution  rates  than  the  industry  average.  The  company  is  justifiably  proud  of  its 
safety  record. 
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9.0  Summary 

As  we  have  seen,  human  error  (and  usually  multiple  errors  made  by  multiple  people  and  at 
multiple  levels  of  the  organization)  contributes  to  the  vast  majority  (over  80%)  of  marine 
casualties  and  offshore  incidents,  making  the  prevention  of  human  error  of  paramount 
importance  if  we  wish  to  reduce  the  number  and  severity  of  maritime  and  offshore  incidents. 
Many  types  of  human  errors  were  described,  the  majority  of  which  were  shown  not  to  be  the 
“fault”  of  the  human  operator.  Rather,  most  of  these  errors  tend  to  occur  as  a  result  of 
technologies,  work  environments,  and  organizational  factors  which  do  not  sufficiently  consider 
the  abilities  and  limitations  of  the  people  who  must  interact  with  them,  thus  “setting  up”  the 
human  operator  for  failure. 


Feedback 


Figure  23.  Tools  for  an  Effective  Incident  Investigation  Program 


Incident  investigation  that  includes  an  analysis  of  human  error  is  needed  if  we  are  to  prevent 
these  incidents  in  the  future.  This  paper  has  presented  several  different  tools  that  can  be  used 
to  perform  a  human  factors  incident  investigation  and  to  use  the  resulting  data  to  improve  the 
company’s  safety  program  (Fig.  23).  Appendix  H  presents  a  selection  of  human-related 
questions  that  can  be  asked  to  identify  potential  human  error  issues.  The  human-system 
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approach  helps  the  investigator  consider  suboptimal  interfaces  and  interactions  between 
people,  technology,  organization,  and  environment  that  may  have  contributed  to  the  incident. 

Reason  (1990)  created  a  useful  framework  for  categorizing  the  types  of  human  error.  His 
“Swiss  cheese”  model  considers  not  just  the  unsafe  acts  of  the  operator,  but  also  considers 
several  layers  of  system  defenses  that  may  need  mending  if  the  safety  program  is  to  be 
effective:  preconditions  for  unsafe  acts,  unsafe  supervision,  and  organizational  factors. 
Reason’s  model  has  been  captured  in  the  Human  Factors  Analysis  and  Classification  System 
(HFACS;  Shappell  &  Wiegmann,  1997a,  2000;  Wiegmann  &  Shappell,  1999),  an  incident 
investigation  system  which  has  been  used  widely  and  successfully  in  military  and  industrial 
incident  investigation.  HFACS  was  presented  in  this  document  because  it  is  relatively  easy  to 
learn  and  use,  and  because  it  has  a  history  of  enabling  successful  safety  programs.  HFACS 
can  be  used  by  the  offshore  and  maritime  industries  to  supplement  existing  incident  data 
systems  with  human  factors  information.  For  companies  that  have  not  yet  begun  an  incident 
investigation  program,  additional  classification  schemes,  both  for  specific  human-related  errors 
(fatigue,  communications,  and  skills  and  knowledge)  and  for  non-human  incident  data  (e.g., 
vessel  or  platform  type,  activities/operations  during  which  the  incident  occurred,  environmental 
and  weather  conditions  that  may  have  played  a  role)  are  provided  in  the  Appendices.  Event 
and  Causal  Factors  Charting  was  introduced  as  an  additional  tool  to  aid  in  understanding  the 
events  that  led  to  an  incident  and  the  causal  factors  that  underlie  those  events.  Used  together. 
Event  and  Causal  Factors  Charting  followed  by  an  HFACS  analysis  of  the  causes  can  provide  a 
powerful  way  to  represent  the  development  of  an  incident  and  to  identify  the  system  failures  that 
generated  and  perpetuated  the  incident. 

It  cannot  be  overemphasized  that  a  good  incident  database  is  only  the  starting  point  for  a 
successful  incident  prevention  program.  An  open,  fair,  improvement-seeking  culture,  a 
common  understanding  of  the  purpose  and  scope  of  the  incident  investigation  program, 
appropriate  training  for  incident  investigators,  a  simple,  user-friendly  database,  and  feedback  on 
the  results  of  the  incident  investigation  program  are  all  essential  elements  to  the  collection  of 
valid  and  complete  incident  data.  In  addition,  regular  analysis  of  the  incident  data  is  required  to 
identify  potential  problems  and  to  evaluate  the  results  of  new  safety  programs.  Several  data 
analysis  techniques  were  summarized  that  can  help  companies  make  the  most  of  their  incident 
data.  As  was  pointed  out,  one  cannot  do  data  analysis  blindly  -  one  must  consider  changes  in 
policies  and  procedures  that  may  have  had  an  effect  on  the  way  data  were  collected  and 
classified.  Thoughtful  analysis  will  help  to  distinguish  spurious  results  from  real  trends  that  may 
require  intervention.  Follow-up  studies  (“data-driven  research”)  are  usually  needed  to 
thoroughly  understand  a  given  safety  issue  and  determine  what  types  of  interventions  may  be 
needed. 

Finally,  we  considered  how  to  select  interventions  based  on  the  types  of  system  defenses  that 
have  failed.  By  linking  Reason’s  “Swiss  cheese”  with  Miller’s  “triangle  of  effectiveness”,  we 
have  a  tool  for  finding  the  most  effective  ways  to  solve  safety  problems.  While  traditional  safety 
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management  seems  to  focus  on  reprimanding,  cajoling,  and  “more  training”,  the  triangle  of 
effectiveness  shows  that  these  are  the  least  effective  ways  for  reducing  incidents.  A  safety 
culture  must  start  at  the  top,  and  so,  too,  must  the  most  effective  interventions.  Management 
participation,  human-centered  workplace  design,  and  human-compatible  environmental  control 
may  require  more  up-front  effort  than  “yet  another  training  course”,  but  because  these  elements 
are  integral  to  the  safe  design  and  operation  of  the  workplace,  they  will  reap  much  larger  safety 
benefits.  The  safety-conscious  organization  “starts  at  the  top”  when  developing  safety 
interventions  to  protect  its  employees,  products,  and  the  environment. 

Human  errors  can  be  reduced  significantly.  Other  industries  have  made  tremendous  progress 
in  controlling  human  error  through  careful  documentation  of  incidents,  analysis  of  incident  data, 
follow-up  studies,  and  top-down,  human-centered  interventions.  Indeed,  maritime/offshore 
industries  can  do  the  same:  the  U.K.’s  Marine  Accident  Investigation  Branch,  California’s 
Marine  Facilities  Division,  and  Stolt-Nielsen  Transportation  Group  have  all  shown  that  the 
maritime/offshore  sector  can  put  human  factors  incident  investigation  to  effective  and  profitable 
use.  By  using  human  factors  incident  investigation  to  identify  weaknesses  in  our  system 
defenses,  and  by  crafting  safety  interventions  through  the  human-centered  design  of 
technologies,  work  environments,  and  organizations,  we  can  support  the  human  operator  and 
foster  improved  performance  and  fewer  incidents. 
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Appendix  A.  Sample  Incident  Reporting  Form^^ 


The  first  step  in  learning  from  incidents  is  to  find  out  that  they  happened!  This  appendix 
presents  a  form  that  can  be  used  by  workers  to  report  incidents  and  near-misses.  If  your 
company’s  incident  database  is  to  contain  information  from  both  investigated  (i.e.,  someone 
acts  on  the  information  in  the  reporting  form  and  opens  an  investigation  of  the  incident)  and 
non-investigated  (i.e.,  the  reporting  form  is  the  only  source  of  information)  incidents,  it  becomes 
important  to  be  able  to  judge  the  “goodness”  or  validity  and  completeness  of  the  incident  data. 
You  may  want  to  add  a  field  to  your  database  to  show  whether  the  incident  was  investigated  or 
not  (or  the  degree  to  which  it  was  investigated).  Another  example  of  rating  the  completeness  of 
the  incident  data  is  shown  in  App.  E  at  the  bottom  of  the  HFACS  Event  Data  Form.  All  these 
incidents  are  investigated,  and  the  investigators  mark  whether  they  believe  they  were  able  to  do 
a  full  investigation. 

The  reporting  form  in  this  appendix  was  developed  for  the  anonymous  reporting  of  near-misses. 
As  such,  it  requests  information  about  both  the  incident  and  the  person  reporting  the  incident. 
Information  about  the  reporter  is  requested  in  order  to  infer  the  likelihood  that  the  reporter  has 
experience  in  the  incident  context  (that  is,  is  the  reporter  likely  to  know  what  correct  procedures 
should  have  been,  and  would  he/she  understand  the  ramifications  of  the  steps  that  led  to  the 
incident).  Question  6  seeks  to  aid  the  assessment  of  the  reliability  of  the  reported  information 
by  finding  out  whether  the  person  who  reported  it  was  actually  involved  in  the  incident  first-hand. 
In  this  way,  one  can  attempt  to  weigh  the  potential  value  of  the  information  in  the  incident  report. 


based  on  a  prototype  of  the  International  Maritime  Information  Safety  System  (IMISS;  see  Rothbium, 
Chaderjian,  &  Mercier,  2000). 
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Incident  Reporting  Form 


Tell  us  about  yourself 

1 .  In  what  maritime  sector  are  you  invoived? 

□  deep  draft 

□  iniand 

□  off-shore 

□  terminai 

□  recreationai 

□  other _ 


2.  What  is  your  specific  job?  {e.g.,  Ordinary 
Seaman,  Asst  Engineer,  driiiing 

supervisor,  dock  worker,  USCG  XO) 


3.  Type  of  vessei  /  faciiity  /  structure  where 
you  typicaiiy  work?  (e.g.,  crude  oii  tanker, 
tension  ieg  piatform,  iiquid  buik  terminai) 


Incident  /  Potentiai  Hazard 

4.  Type  of  incident  or  hazard  (e.g.,  near-coiiision, 
near-injury;  buoy  off-station,  dangerous  work 
practice) 


6.  How  were  you  invoived  in  the  incident  (or 

discovering  the  hazard)? 

□  directiy  invoived  -  I  was  an  active  participant. 

□  indirectiy  invoived  -  I  was  at  the  scene,  and 
saw/heard  everything  that  happened. 

□  observed  from  a  distance  -  I  did  not  see/hear 
everything. 

□  not  invoived  -  I  heard  about  this  from 
someone  eise. 

□  other  (describe): 


5.  When  did  the  incident  /  hazard  occur? 

Date:  /  /  □  dawn 

mm  /  dd  /  yy  □  dayiight 

□  dusk 

Time: _ am/pm  □  night 

7.  Type  of  vesseis,  piatforms,  structures,  or 
faciiities  invoived  (e.g.,  lineboat  trawler, 
shipyard,  jack-up  rig): 


8.  Describe  the  visibiiity,  weather,  and  water 
conditions. 

(e.g.,  overcast  light  rain,  no  wind,  river  stage  8 
ft  and  rising) 


9.  Where  did  it  happen?  (specify  the  waterway,  port  location  on  ship,  etc.): 


10.  What  specific  operation(s)  was  occurring  at  the  time  of  the  incident  or  hazard?  (e.g.,  normal 
bridge/pilothouse  watch,  normal  engineroom  watch,  cargo  transfer  operation,  ballasting,  making 
tow,  fishing) 
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11.  Describe  what  happened.  What  were  the  events  which  ied  up  to  the  probiem?  How  was  the 
probiem  discovered?  What  happened  next?  (be  as  specific  as  possibie,  and  put  events  in  the 
order  in  which  they  happened)  For  a  potentiai  hazard,  describe  the  situation  and  what  couid  have 
happened. 


12.  What  do  you  think  caused  the  incident  or  contributed  to  the  events  surrounding  the  incident? 
(Consider:  decisions;  actions;  inactions;  information  overbad;  communication;  fatigue;  drugs  or 
aicohoi;  physicai  or  mentai  condition;  procedures;  poiicies;  design  of  equipment  /  ship  /  faciiity  / 
waterway;  crew  /  workers  (experience,  manning);  weather;  visibiiity;  equipment  faiiure  (why  did  it 
fait?);  maintenance.) 


13.  What  went  right?  How  was  an  accident  avoided?  (Consider:  corrective  actions;  contingency 
pians;  emergency  procedures;  tuck.) 


14.  How  can  we  prevent  simiiar  incidents  (correct  the  hazard)?  What  changes  need  to  be  made? 
By  whom?  This  biock  is  aiso  for  describing  Lessons  Learned,  Safety  Tips,  and  Suggestions. 
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Appendix  B.  Database  Items  on  General  Incident  Information^^ 

(to  be  collected  in  addition  to  the  human  error  data) 


Time,  Location,  and  General  Conditions 

Date:  /  / 

mm  /  dd  /  yy 

Month  and  Year:  / 

mm  /  yy 

Day  of  Week:  Su  Mo  Tu  We  Th  Fr  Sa 
Local  Time:  _ (24-hr  clock) 


Location  of  vessel/platform/facility 
Port/Harbor 
Terminal 
Pier 

At  Anchor 

Restricted  waters  (marked  channel,  bay,  etc. 
Ocean  (>  12  nm) 

Coastal  (<  12nm) 

Inland  waters 
River 

Great  Lakes 
Lake 

Bay /Sound  /  Strait 

Offshore  Platform  in  State  Waters  (  <3nm) 
Offshore  Platform  in  Federal  Waters  (  >3nm) 
Other _ 


Specific  Location 

Lat: _ 

Long: _ 

Type  of  Aid  to  Navigation: _ 

Waterbody  /  Waterway  name: 

Port  /  Flarbor  name: _ 

Water  depth _ ft. 

Mile  Marker _ 


based  on  a  prototype  of  the  International  Maritime  Information  Safety  System  (IMISS;  see  Rothblum, 
Chaderjian,  &  Mercier,  2000). 
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Light 

Dawn  (morning  twilight) 
Daylight 

Dusk  (evening  twilight) 
Night 

Visibility 

Visibility: _ nm 

Clear 

Cloud  cover 
Fog 
Other 

Weather 

Calm 
Rain 
Snow 
Hail 

Waterspout 
Other _ 


Thunderstorm 

Sleet 

Hurricane 

Tornado 


Water  Conditions 

Salinity  (fresh/salt) _ 

river  stage _ ft.  Rising  OR  Falling 

Flood  stage _  Above  gauge  level _  At  gauge  level _ 

Below  gauge  level _  Low  gauge  level _ 

Swells: _ ft.  OR  sea  state  _ 

Wave  height  _  ft;  Wave  period _  sec;  Wave  Direction 

Current  velocity: _ 

Current  direction _ 

Ebb/Flood 

Tide:  Rising/  Falling  Hours  since  high/low  water _ 

Obstructed/Floating  debris:  Describe _ 

Other _ 

Wind:  direction: _  speed: _ kts. 


Number  of  vessels  involved  _ 

Number  of  facilities/platforms  involved 
Number  of  people  involved _ 


degrees 
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Vessel  activity,  Vessel  #1  (check  all  that  apply) 


Vessel  not  underway 

Fishing 

USCG  /  Military 

Docked 

Fishing 

CG  -  patrolling 

At  anchor 

Trolling 

CG  -  boarding 

Moored 

Trawling 

CG  -  interdiction 

Longlining 

CG  -  transit 

Vessel  in  port 

Dive 

CG  -  towing 

Docking/undocking 

Siening 

CG  -  setting  buoys 

Mooring/Releasing  Lines 

Dragging 

CG  -  ice  breaking 

Maneuvering 

Hauling  Gear 

CG  -  assist 

Shifting  dock-to-dock 

Setting  Gear 

CG  -  helo  ops 

Embark/disembark  pilot 

Setting  pots/traps 

UNREP  Ops 

Embark/disem. 

Fish  processing 

Other  CG  ops 

Passengers 

Transfer  oil/chemicals 

Other  fishinq 

Other  military  ops 

Transfer  containers 

Towing 

Test  &  Repair 

Transfer  bulk  cargo 

Towing/pushing/hip 

Testing  main  engines 

Transfer  break  bulk 

Locking 

Shut-down  Engines/Cargo 

Bunkering 

River  upbound 

Equipment  testing 

Tug  escort 

River  downbound 

Deck  Machinery 

Break  Bulk  Cargo 

Make/break  tow 

Electronics 

Other  cargo  activitv 

Other  towinq 

Maintenance 

Other  port  activitv 

Repairs 

Other  Commercial  Activity 

Safety  Equipment  Test 

Transiting 

Production  (platform) 

Engine  Dept  Equipment 
Test 

Channel  inbound 

Logging 

Deck  Equipment  Test 

Channel  outbound 

Drilling  Crew  shift 

Cargo  Monitor  Equipment 
Test 

Port  inbound 

Tank  cleaning 

Port  outbound 

Ballasting/deballasting 

Other  Vessel  Activities 

Open  waters  transit 

Lightering 

Recreational  boating 

Great  Lakes  transit 

Bunkering/Fueling 

Evacuation 

Meeting 

Prep  for  extreme  event 
(e.g.,  hurricane) 

Passing/Overtaking 

Transfer-related 

Other 

Crossing 

Cargo  Transfer  at  Anchor 

Overtaking 

Diving 

Tug  escort 

Touring 

Other  transit 

Launch  Service 

Other  commercial 

Vessel  Activity,  Vessels  #2  and  #3  (repeat  above) 
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Facility  Activity  (check  all  that  apply) 


Maintenance 
Equipment  testing 
Dry  clocking 

Dock  loading/unloading 
Dock  crane  operations 
Loading  Containers 
Staging  Containers 


Rail  Operations 
Truck  Operations  in  Yard 
Training  Workers 
Oil  Transfer 
Dry  Bulk  Transfer 
Break  Bulk  Transfer 
Chemical  Transfer 


Incident/Hazard  Event  (check  all  that  apply) 


Vessel/platform  event 

Abandonment 

Evasive  maneuver 

Allision 

Explosion 

Blowout 

Fire 

Capsize 

Flooding 

Collision 

Fouling 

Damage  to  cargo 

Grounding 

Damage  to  environment 
Emergency  response 

Implosion 

Personnel  event 

Amputation 

Drowning 

Asphyxiation 

Electrocution 

Broken  bone 

Fall  into  water 

Burn 

Paralysis 

Crush 

Severe  bleeding 

Cut 

Slip/trip/fall 

VTS  operations 
Bridge  opening/closing 
Lock  operations 
Other  activity _ 


Loss  of  electrical  power 
Loss  of  maneuverability 
Loss  of  stability 
Material  failure 
Material  failure,  diving 
Set  adrift 
Sinking 

Other _ 


Sprain/strain 
Struck  by  object 
Other _ 
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Type  of  Vessel:  Vessel  #1  (check  one) 


Tank  Vessel 

Petroleum 
LNG  tanker 
Chemical 

Other  tanker _ 

Freight  Vessel 

Breakbulk 
Bulk,  Ore 
Bulk,  Grain 

Bulk,  Other _ 

Container  ship 

Tow  and  Barge 

Towing  vessel 
Tow  and  barge  combo 
Barge  w/o  towboat 

Tank  barge _ 

Freight  barge _ 

Other  barge _ 

Tug  escort 
Composite  Unit 


Passenger 

Passenger,  small 
Passenger,  large 
Ferry 

Casino  boat 
Cruise  ship 

Other  Vessels/Platforms 

Fishing  vessel 

Fish  processor 

Offshore  supply  vessel 

Platform/rig 

Workboat  (platform) 

MODU 

OBO 

Fleavy  lift 

Dredge 

Pilot  boat 

Other  commercial _ 

FISC  [Fligh  speed  craft] 
Flydrographic  survey 
Emergency  Response 


USCG  /  Military 

CG  cutter 
CG  small  boat 
CG  ice  breaker 
CG  buoy  tender 

CG  other _ 

Other  military _ 

Recreational 

Jet  Ski 
Sail  boat 
Powerboat 

Other  recreational  boat 


(repeat  above  for  vessels  #2  and  #3) 


Type  of  Facility:  Facility  #  1  (check  one) 


Cargo  Facilities 

Port  /  pier  /  dock 

Container  terminal 

Liquid  Bulk  terminal 

Solid  Bulk  with  self  loading  systems 

Bulk  cargo  facility 

Break  bulk  cargo  facility 

Oil/chemical  facility 

Container  facility 

Other  cargo  facility _ 

Moorings 

Single  point  moorings 
Multi  buoy  moorings 
Offshore  moorings 


Platforms  /  Drilling 

Offshore,  Fixed  platform 
Jack-up  rig 

Mobile  Oil  Production  Units 

Compliant  Tower 

Tension  Leg  Platform 

Other  deep  water 

production/drilling  facilities 

Lifeboat 

Other  Facilities 

Designated  waterfront  facility 
Shipyard  /  Dry  dock 
Marina 
VTS 

Waterfront  Facility 


(repeat  above  for  Facility  #  2) 
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Person  #  1  (check  one) 


Crew  on  Deep  Draft  Ship 

Crew  on  Towing  Vessel 

Crew  on  USCG/Military 

Master 

Captain/Pilot  (towing) 

1  Class  operator 

CG  Command  (CO,XO,EO) 

Chief  mate 

Mate  (towing) 

2’^^  Class  Operator 

CG  bridge  crew 

1  Mate 

Deckhand 

CG  engineering 

2  Mate 

Engineer 

CG  other 

3  Mate 

Cook 

Other  militarv 

4  Mate 

Other  towinq 

AB 

Waterway  Personnel 

OS 

Port  /  Dock  Workers 

Lock  Master 

Boatswain 

Dock/Harbor  Master 

Bridge  Tender 

Other  Deck 

Port  Engineer 

VTS 

Chief  Engineer 

Port  Captain 

Federal  Pilot 

1  Asst.  Eng. 

Port  Pilot 

State  Pilot 

2  Asst.  Eng. 

Port  Safety  Rep. 

Other  Waterway 

3  Asst.  Eng. 

Mooring  Master 

OMED/Oiler/Wiper 

Line  Handlers 

Platform  /  Rig  Crew 

Maintenance  Dept. 

Hose  Crew  (Hook  up) 

Operations  supervisor 

Other  Enq. 

Hose  Watch 

Logging 

personnel/contractor 

Terminal  Person  in  Charge 

Drilling  supervisor/engineer 

Chief  Steward 

Longshoreman 

Platform  foreman 

Steward 

Dock  Worker 

Platform  crew 

Chief  Cook 

Gaugers 

Drilling  supervisor/engineer 

Cook 

Pilot 

Drill  rig  personnel 

Purser 

Docking  Pilot 

Other 

Waiter 

Other  Port 

Other  Deep  Draft 

Other  Personnel 

Cadet 

Shipyard  /  Inspections 

Vendor 

Trainee 

Shipyard  worker 

Agent 

Pumpman 

Ship  chandler 

Visitor 

Entertainer 

Government  Inspector 

Passenger 

Class  society  inspector 

Recreational  boater 

Insurer 

Ship  Chandler 

Surveyor 

Other 

Other 
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Person  #1  ’s  Activity  at  Time  of  Incident  (check  as  many  as  apply) 


On-board  Activity 

Watch  /  work  /  OT 
Off  duty 

Navigation  watch 
Engineering  watch 
Eng.  Maintenance/repair 
Deck  maintenance 
Handling  lines 
Make/break  tow 
Load/discharge  cargo 
Load/discharge 
passengers 
Meal  prep./serve 
Other  on-board _ 

Facility  Crew  Activity 

Describe _ 


Platform  Crew  Activity 

Drilling  operations 

Normal  production 

operations 

Crane  operations 

Maintenance 

Testing 

Evacuation 

Off  duty 

Other  platform _ 

Shipyard  Crew  Activity 

Dry  dock 
Ship  repair 
Logging 

Other  shipyard _ 


Military  Crew  Activity 

Watch  /  work 
Off  duty 

Collateral  duty 
Navigation  watch 
Engineering  watch 
Maintenance 
CG  boarding  team 

CG  helo  ops 
CG  setting  ATONs 

CG  launching  small  boat 

CG  other _ 

Other  military _ 

Other _ 


Person  #1’s  Impairments  (check  as  many  as  apply  to  incident) 


Fatigue 

Suspected  alcohol  intoxication 
Suspected  drug  intoxication 
Rx/OTC  medications 
Illness 
High  stress 

Chronic  health  condition: _ 

Psychological  condition: _ 

Other _ 


Hearing  impairment 
Vision  impairment 
Impaired  mobility 
Speech  impediment 
Poor  or  no  English 


(repeat  Person,  Activity,  and  Impairments  for  Persons  #  2,  3,  and  4) 
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Equipment  Factors  (check  as  many  as  apply  to  the  incident) 


Vessel  Equipment  which 

Platform  Equipment  which 

Problem: 

failed: 

failed: 

Steering  gear 

Drill  rig 

Inoperable 

Engine 

Drill  equipment  (tanks) 

Operated  incorrectly 

Generator 

Pipelines  &  valves 

Reefers 

Crane 

Cause: 

Radar/ARPA 

Compressors 

Lack  of  maintenance 

Electronic  chart 

Safe  shut-down  equipment 

Improper  maintenance 

Communications  system 

Gas  handling  units 

Design/manufacture  error 

Other  bridge  equipment 

Hoses 

Improper  use 

Winch 

Separators 

Operator  error 

Lines 

Fire  detection/control 

Inadequate  training 

Crane 

Command  &  Control 

equipment 

Other 

Electrical 

0-ring/gasket 

Piping 

Other  platform 

Location  of  equipment 

Door/hatch 

Bridge 

Sanitation 

Engine  room 

Anchor/chain 

Safety  &  Personal 
Protection  Gear 

Deck 

Vent  system 

Firefighting  equipment 

Tanks 

Pump 

Fire  suppression  equipment 

Other 

Valves 

Life  jackets/preservers 

Remote  control/monitoring 

Life  boats 

systems 

Cold  water  immersion  suits 

Other  vsl  equip 

Hearing  protection 

Eye  protection 

Head  protection 

Chemical  protection  gear 
Respirators 

Other  safety 

Waterway  Factors  (check  all  that  apply) 

high/low  river  stage 

strong  current 

buoy  off-station 

nav  aid  not  working 

poorly  marked  waterway 

bridge  not  marked 

Last  Chart  Survey  of  Area 

Where  charts  corrected  for  latest 

survey  (ship  on  dock) 

Additional  permitted  activities 
Debris  in  water 


dangerous  crossing 
dangerous  traffic  scheme 
channel  width/depth  not  as  charted 
Narrow  channel 
dangerous  sandbars/shoals 
dangerous  port  design/layout 

Nav  aid  not  available  such  as  DGPS  off  air 

Severe  weather/waves 
Other: _ 
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Appendix  C.  Examples  of  Human  Factors  Taxonomies 

(in  alphabetical  order  by  system  name) 


Incident/ Accident  System 

Agency 

Reference 

Aviation  Safety  Reporting 
System  (ASRS) 

run  by  NASA  for  the  FAA;  used  by 
commerciai  aviation  (flight  crews, 
ground  crews,  and  air  traffic 
controi) 

Reynard  W.D.,  Biiiings  C.E., 
Cheaney  E.S.,  &  Hardy  R. 

(1 986) .  The  Development  of  the 
NASA  Aviation  Safety  Reporting 
System.  NASA  Reference 
Pubiication  1-1-14.  Nationai 
Aeronautics  and  Space 
Administration. 

Confidentiai  Hazardous 

Incident  Reporting  Programme 
(CHIRP) 

Concerted  Action  Committee  on 
Casuaity  Anaiysis  (European 
Commission) 

Concerted  Action  Committee  on 
Casuaity  Anaiysis  (1998). 
Confidential  Hazardous  Incident 
Reporting  Programme.  FP4 
Waterborne  Transport  Tasks  21 
and  36.  (draft) 

Human  Error  Root  Cause 
Anaiysis  (HERCA) 

U.S.  Dept,  of  Energy 

Coiiopy  M.T.  &  Waters  R.M. 

Human  Factors  Anaiysis  and 
Ciassification  System 
(HFACS) 

US  Navy  and  Marine  aviation 

Shappeii  S.A.  &  Wiegmann  D.A. 
(1997)  A  human  error  approach 
to  accident  investigation:  The 
taxonomy  of  unsafe  operations. 
International  J.  Aviation 
Psychology,  7(4),  269-291. 

Human  Factors  Checkiist,  and 
others  based  on  the  SHEL- 
GEMS  modeis 

Internationai  Civii  Aviation 
Organization  (ICAO); 

Transportation  Safety  Board 
(TSB)  of  Canada; 

US  Coast  Guard;  Internationai 
Maritime  Organization  (IMG) 

ICAO  (1993).  Investigation  of 
Human  Factors  in  Accidents  and 
Incidents.  Human  Factors 

Digest  No.  7,  ICAO  Circular  240- 
AN/144.  Montreal,  Canada: 
Author. 

TSB  of  Canada  (1988).  An 
Integrated  Process  for 
Investigating  Human  Factors. 
Montreal:  Author. 

International  Maritime 
Organization  (1998).  Role  of  the 
Human  Element  in  Maritime 
Casualties.  Maritime  Safety 
Committee,  69*'^  Session, 

Agenda  Item  13  (MSC/69/13-1). 
London:  Author. 
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Human  Factors  Investigation 
Tooi  (HFIT) 

prototype  in  testing 

Gordon  R.,  Flin  R.  &  Mearns  K. 
(2001).  Designing  a  Human 
Factors  Investigation  Tool  to 
Improve  the  Quality  of  Safety 
Reporting.  Proceedings  of  the 
Human  Factors  and  Ergonomics 
Society  4^^  Annuai  Meeting, 
1519-1523. 

Human  Performance 
Investigation  Process  (HPIP); 

TapRooT  (a  commerciai 
revision  of  HPIP) 

Nuclear  Regulatory  Commission 
and  various  industries 

Paradies  M.,  Unger  L.,  Haas  P., 

&  Terranova  M.  (1993) 
Deveiopment  of  the  NRC’s 

Human  Performance 

Investigation  Process,  Voi.  1-3. 
Report  #  NUREG/CR-5455. 
Washington,  DC:  Nuclear 
Regulatory  Commission. 

Paradies  M.,  Unger  L.,  &  Busch 

D.  (199x).  Root  Cause  Tree 
User’s  Manuai,  Revision  3. 

Influence  Networks 

UK  Maritime  and  Coastguard 
Agency  (MCA);  UK  Health  and 
Safety  Executive  (HSE); 
International  Maritime 

Organization  (IMG) 

Embrey,  D  (1992)  Incorporating 
Management  and  Organisational 
Factors  into  Probalistic  Safety 
Assessment.  Reiiabiiity 
Engineering,  38,  199-208. 

BOMEL  Limited  (2001)  ESA  of 
Buik  Carriers  -  Deveiop-ment 
and  Quantification 
of  Infiuence  Networks 
(undertaken  for  MCA,  UK). 

International  Maritime 
Information  Safety  System 
(IMISS) 

prototype  system  developed  by  a 
SNAME  working  group,  sponsored 
by  US  Coast  Guard  and  US 
Maritime  Administration 

Rothblum  A.,  Chaderjian  M.,  and 
Mercier  K.  (2000).  Development 
and  Evaluation  of  the 

International  Maritime 

Information  Safety  System 
(IMISS).  Presented  at  the 

Society  of  Naval  Architects  and 
Marine  Engineers,  IMISS  Public 
Meeting,  May  2000. 

Marine  Safety  Reporting 

System  (MSRS) 

Human  Factors  Group 

Safe  Marine  Transportation 
(SMART)  Forum  of  Puget 

Sound,  1997.  Marine  Reporting: 
The  Deveiopment  of  a 

Northwest  Marine  Safety 
Reporting  System.  Seattle,  WA: 
Author,  (see  App.  D) 
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Appendix  D.  Human  Factors  Taxonomy  used  by  the 

U.K.  Marine  Accident  Investigation  Branch 

External  Bodies  Liaison 

Non  compliance 

Communication 

Equipment  design  -  manufacturer 

Training,  skills,  knowledge 

Working  environment/workplace 

Incorrect  installation/defective  equipment 

Company  &  Organisation 

Company  standing  orders  inadequate,  insufficient,  conflicting 
Manufacturer’s  instructions 

Communication 

Pressures  -  organisational 

Inadequate  resources 

Training,  skills,  knowledge 

Crew  Factors 

Communication 

Management  and  supervision  inadequate 

Allocation  of  responsibility  inappropriate 

Procedures  inadequate 

Manning  (rotation/watches) 

Training 

Discipline  -  crew/passengers 

Unsafe  working  practices 

Equipment 

Equipment  misuse 

Equipment  not  available  as  needed 

Equipment  poorly  designed  for  operational  use 

Equipment  badly  maintained 

Personnel  unfamiliar  with  equipment/not  trained  in  use 

Automation  means  crew  not  trained  in  use  of  manual  alternatives 

Working  Environment 

Performance  affected  by  noise 

Performance  affected  by  vibration 

Performance  affected  by  temperature 

Performance  affected  by  humidity 

Performance  affected  by  visual  environment/visibility 

Performance  affected  by  ship  movement/weather  effects 

Poor  housekeeping 

Layout  unsuitable  for  task 

Accommodation 

Individual 

Communication 
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Competence  and  skill 

Training,  inexperience,  knowledge 

Violation  of  procedures 

Health:  drugs/alcohol 

Health:  medical  condition 

Domestic  issues 

Fatigue  and  vigilance 

Perceptual  abilities 

Poor  decision  making/information  use 

Perception  of  risk 

Workload 
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Appendix  E.  Adaptation  of  HFACS  by  the  California  State  Lands  Commission, 

Marine  Facilities  Division 

This  appendix  shows  how  the  Marine  Facilities  Division  (MFD)  of  the  California  State  Lands 
Commission  has  adapted  the  Fluman  Factors  Analysis  and  Classification  System  (FIFACS)  to 
their  specific  needs.  Below  are  the  guides  (job  aids)  provided  to  MFD  inspectors  for  their  use  in 
investigating  the  human  factors  and  other  causes  of  oil  spills.  The  job  aids  contained  herein 
include: 

•  FIFACS  Terminology 

•  FIFACS  Layer  Guides 

•  FIFACS  Event  Data  Form  (filled  out  during  a  spill  investigation) 

•  Event  Data  Form  Instructions 

Note  that  the  term  “Layer”  refers  to  the  “slice  of  cheese”  being  considered:  Layer  1  equates  to 
Unsafe  Acts;  Layer  2  to  Preconditions;  Layer  3  to  Unsafe  Supervision;  and  Layer  4  to 
Organizational  Influences.  The  term  “Tiers”  is  a  short-hand  notation  for  the  levels  of  the 
taxonomy  being  considered.  For  example,  Tier  1  is  the  Layer  or  top  level  classification  (e.g., 
unsafe  act).  Tier  2  would  be  the  next  level  of  classification,  such  as  an  “Error”  (unintentional)  as 
the  type  of  unsafe  act.  Tier  3  would  be  the  bottom  or  most  specific  level  of  classification,  such 
as  “Skill-based”  errors.  “Pick-List”  refers  to  the  items  or  types  of  the  Tier  3  factor,  such  as 
“omitted  step  in  procedure”  under  Skill-Based  Errors. 

As  discussed  in  the  report,  MFD  adapted  FIFACS  to  its  needs  by  incorporating  non-FIF  items 
into  the  investigation  paradigm.  For  example,  in  addition  to  Unsafe  Acts  under  Layer  1,  MFD 
included  the  category  Structural/Mechanical  Damage/Failure  to  help  inspectors  consider  the 
equipment  factors  that  contributed  to  the  incident  and  how  human  factors  caused  or 
complemented  the  equipment  factors  in  the  evolving  oil  spill. 
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HFACS  Terminology 

Accident.  An  unintended  event  which  results  in  personal  injury,  illness,  property  damage,  or 
environmental  impairment. 

Near  Miss:  An  unintended  event  which  has  the  potential  for  causing  personal  injury,  illness, 
property  damage  or  environmental  impairment. 

Incident.  An  unintended  event  which  results  in  or  has  the  potential  for  causing  personal  injury, 
property  damage,  or  environmental  impairment. 

Routine  Violation  (from  Reason,  1990):  Two  factors,  in  particular  appear  to  be  important  in 
shaping  habitual  violations:  (a)  the  natural  human  tendency  to  take  the  path  of  least  effort;  and 
(b)  a  relatively  indifferent  environment  (i.e.,  one  that  rarely  punishes  violations  or  rewards 
observance).  Everyday  observation  shows  that  if  the  quickest  and  most  convenient  path 
between  two  task-related  points  involves  transgressing  an  apparently  trivial  and  rarely 
sanctioned  safety  procedure,  then  it  will  be  violated  routinely  by  the  operators  of  the  system. 
Such  a  principle  suggests  that  routine  violations  could  be  minimized  by  designing  systems  with 
human  beings  in  mind  at  the  outset. 

Error,  a  generic  term  to  encompass  all  those  occasions  in  which  a  planned  sequence  of 
activities  fails  to  achieve  its  intended  outcome,  and  when  these  failures  and  when  these  failures 
cannot  be  attributed  to  some  chance  agency. 

Slip  and  lapse,  errors  which  result  from  some  failure  in  the  execution  and/or  storage  of  an 
action  sequence,  regardless  of  whether  or  not  the  plan  which  guided  them  was  adequate  to 
achieve  its  objective.  Slips  are  observable;  lapses  not. 

Mistake,  deficiencies  or  failures  in  the  judgemental  and/or  inferential  processes  involved  in  the 
selection  of  an  objective  or  in  the  specification  of  the  means  to  achieve  it,  irrespective  of 
whether  or  not  the  actions  directed  by  this  decision-scheme  run  according  to  plan. 
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Layer  1  Guide:  Unsafe  Acts 


Unsafe  Acts 


Errors 

Skill-based 

Perceptual 

Decision 

failed  to  prioritize  attention 

misjudged  distance/rate/time  improper  procedure  or 

inadvertent  use  of  controls 

misread  dial  or  indicator  misdiagnosed  emergency 

omitted  step  in  procedure,  or 
executed  step  out-of- 
sequence. 

failed  to  see/hear/otherwise  wrong  response  to  emergency 
sense 

omitted  checklist  item  or 
completed  check  list  item  out- 
of  sequence. 

poor  decision 

Violations 

Routine 

Exceptional 

(Fill  in)  Definition:  Common  or  habitual 
instance  of  breaking  the  rules  and 
regulations  (taking  a  shortcut)  that  is  part  of 
a  person’s  behavior  pattern  and  is  often 
tolerated  by  the  organization 

(Fill  in)  Definition:  Isolated  departure  from 
authority,  rules  and  regulations  (taking  a 
shortcut)  that  is  typically  not  condoned  by 
management 

Structural/Mechanical  Damage/Failure 


Vessel  Control  Vessel  Structural 

System 

Terminal  Control  Terminal  Structural 

System 

containment 

containment 

flange/gasket 

flange/gasket 

hose 

hose 

inert  gas  system 

loading  arm 

loading  arm 

pipeline 

pipeline 

pump 

piping 

shell  plating 

pump 

valve 

shell  plating 

stern  tube 

valve 
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Layer  2  Guide:  Preconditions  For  Adverse  Events 


Preconditions  For  Adverse  Events 

Substandard  Conditions  of  Operators 

Adverse  Mental  States 

Adverse  Physiological  States 

Physical/Mental  Limitations 

channelized  attention 

impaired  physiological  state 

insufficient  reaction  time 

complacency 

medical  illness 

poor  vision/hearing 

distraction 

physiological  incapacitation 

lack  of  knowledge 

mental  fatigue 

physical  fatigue 

incompatible  physical 
capability 

haste 

loss  of  situational  awareness 

misplaced  motivation 

task  saturation 

Substandard  Practices  of  Operators 

Crew  Resource  Mgt. 

Personal  Readiness 

impaired  communications  due  to  language  difference 

self-medicated 

interpersonal  conflict  among  crew 

inadequate  rest 

failed  to  use  all  available  resources 

failure  of  leadership 

misinterpretation  of  traffic  calls 

failed  to  conduct  adequate  brief 

impaired  communication/conflict  due  to  cultural  difference 

Substandard  Work  Interface 

Adverse  Environmental 

Conditions 

Substandard  Design 

Substandard 

Maintenance 

low  visibility 

design  design 

inadequate  for  inadequate  for 
use  maintenance 

ambiguous  instrumentation 

poorly  maintained 
equipment 

storm 

inadequate  layout  or  space 

poorly  maintained 
workspace 

extreme  temperature 

substandard  illumination 

poorly  maintained 

communications 

equipment 

extreme  sea  state 

substandard 

communications  equipment 

equipment  substandard  for 
job 
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Layer  3  Guide:  Unsafe  Supervision 


Unsafe  Supervision 


Inadequate  Supervision 

Planned  Inappropriate 
Operations 

Failed  to  Correct  a 
Known  Problem 

Supervisory 

Violations 

failed  to  provide 
guidance 

failed  to  provide  correct 
data 

failed  to  correct 
document  in  error 

authorized  an 

unnecessary 

hazard 

failed  to  provide 
operational  doctrine 

failed  to  provide  adequate 
brief  time 

failed  to  identify  an  at- 
risk  behavior 

failed  to 
enforce  rules 
and  regulations 

failed  to  provide 
oversight 

improper  manning 

failed  to  initiate 
corrective  action 

authorized 

unqualified 

crew 

failed  to  provide  training 

adequacy  of  operational 
procedure  or  plan 

failed  to  report  unsafe 
tendencies 

failed  to  track 
qualifications 

provided  inadequate 
opportunity  for  crew  rest 

failed  to  track 
performance 

Layer  4  Guide:  Organizational  Influences 


Organizational  Influences 


Resource  Management 

Organizational  Climate 

Organizational  Process 

inadequate  management  of 
human  resources 

adequacy  of  organizational 
structure 

adequacy  of  established 
conditions  of  work 

inadequate  management  of 
monetary  resources 

adequacy  of  organizational 
policies 

adequacy  of  established 
procedures 

inadequate  design  and 
maintenance  of  facilities 

adequacy  of  safety  culture 

adequacy  of  oversight 

Working  Group  1  -  HFW2002 


Page  109  of  141 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


HFACS  Event  Data  Form 


Control  #: 

OES  #:  Event  Date:  Event  Time: 

Facility  WO  #: 

Facility  Name: 

Vessel  Name:  _  .  , , 

Reviewed  bv: 

Substance:  „  ,, 

Quantity :  gallons 

Event  Tvoe 

_ Spill 

_ Class  3  Violation 

Evolution 

_ Ballasting/Deballasting 

_ Bunkering 

_ Fueling 

_ Idle 

_ Intra-Terminal 

_ Intra-Vessel 

_ Load/Discharge 

_ Maintenance 

_ Maneuvering 

_ Term/Term 

Who/What 

Incident  Causal  Factor 

Tier  1 

Tier  2 

Tier  3 

Pick-List 

_ Testing 

_ Other 

Event 

_ Arrival 

_ Depart 

_ Disconnect 

_ Flook-up 

_ Start-Up 

_ Steady 

_ Stripping 

Topping  off 
_ N/A 

T ransfer-  Related : _ Yes  _ No 

Responsible  Party: _ Vessel  _ Terminal  _ Other 

Layer  Completeness  1 :  Y  N  2:  Y  N  3:  Y  N  4:  Y  N 

Updated  Substance: 

Quantity:  gallons 

Date: 

Notes  (Outside  Influences;  recommendations;  contributors): 
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Event  Data  Form  Instructions; 


Top  Sections 

1 .  Control  #:  The  control  #  uniquely  identifies  the  database  record  for  this  event.  This  number 
gets  assigned  at  the  point  of  computer  data  entry.  It  can  be  left  blank  by  the 
inspector/specialist/analyst  completing  the  form. 

2.  OES#:  This  number  is  assigned  by  The  Office  of  Emergency  Services  and  can  be  found  on 
the  Hazardous  Materials  Spill  Report  associated  with  the  spill  event.  For  a  class  3  violation, 
this  section  should  be  left  blank. 

3.  Event  Date:  Enter  the  month,  day  and  year  of  the  spill  or  violation  event  in  mm-dd-yyyy 
format. 

4.  Event  Time:  For  spills,  enter  the  time  of  day  that  the  spill  occurred.  This  time  can  usually  be 
found  on  the  Hazardous  Materials  Spill  Report.  For  class  3  violations,  enter  the  time  of  day 
the  violation  was  noted. 

5.  Facility  WO  #:  Enter  the  work  order  number  associated  with  the  facility  where  the  event 
occurred. 

6.  Facility  Name:  Enter  the  name  of  the  facility  where  the  event  occurred. 

7.  Vessel  Name:  Enter  the  name  of  the  vessel,  if  any,  involved  in  the  event. 

8.  Reviewed  by:  Each  staff  member  that  produces  or  reviews  the  completed  form  should  initial 
here.  Each  form  should  be  produced  by  and  reviewed  by  a  specialist,  inspector  and  human 
factors  analyst  at  a  minimum  before  it  is  ready  for  data  entry. 

9.  Substance:  Enter  the  product(s)  involved.  For  a  violation,  enter  the  product  involved  only  if 
the  violation  occurred  during  a  transfer  event. 

10.  Quantity:  For  a  spill  event,  enter  the  amount  of  product  spilled,  in  gallons.  For  a  violation, 
this  section  should  be  left  blank  . 

Left  Sections 

1 .  Event  Type:  Check  the  appropriate  blank  indicating  whether  the  event  is  a  spill  or  a  class  3 
violation. 

2.  Evolution:  Check  appropriate  blank(s)  indicating  the  type  of  operation  that  was  in  progress 
when  the  event  occurred. 

3.  Event:  If  the  event  occurred  during  a  transfer,  note  the  phase  of  the  transfer  by  checking  the 
appropriate  phase. 
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Center  Grid  Sections 

1 .  Who/What:  Indicate  one  of  the  following: 

•  A  person  or  group  of  persons  associated  with  the  incident  causal  factor  identified  identify 
in  column  two.  Use  job  titles  rather  than  names;  For  example,  tankerman,  dockworker, 
TRIG,  VPIC,  chief  mate,  operations  manager,  terminal  manager,  barge  company, 
shipping  company,  etc. 

•  A  damaged  or  malfunctioning  facility  structure  or  piece  of  equipment  associated  with  the 
incident  causal  factor  identified  in  column  two. 

•  An  environmental  condition  or  event  associated  with  the  incident  causal  factor  identified 
in  column  two. 

2.  Incident  Causal  Factor:  a  prevailing  condition,  act,  or  omission  that  contributes  to  bringing 
about  an  adverse  event. 

Note:  For  each  row  in  the  grid,  The  “Who/What”  (column  1)  entry  and  the  “Incident 
Causal  Factor”  (column  2)  entry  should  combine  to  form  a  sentence. 

Refer  to  the  document  Human  Factors  Analysis  and  Classification  System  -  Marine 
Facilities:  Definitions  for  a  description  of  each  tier  &  classification  in  HFACS.  You  can  also 
use  the  HFACS  Tier  and  Layer  Chart  for  a  map  of  tiers  and  layers. 

3.  Tier  1 :  Enter  the  most  general  category  for  the  who/what  &  incident  causal  factor  listed. 

4.  Tier  2:  Enter  the  subcategory  for  the  who/what  &  incident  causal  factor  listed. 

5.  Tier  3:  Enter  the  subtype  for  the  who/what  &  incident  causal  factor  listed. 

6.  Pick-List:  For  subcategories  and  subtypes  that  have  pick-list  items  listed  in  the  HFACS 
Layer  Guides,  select  a  specific  factor  from  the  list  that  best  describes  the  incident  causal 
factor. 

Bottom  Sections 

1.  Transfer-Related:  Check  to  indicate  whether  the  spill  or  class  3  violation  is  transfer- 
related. 

2.  Responsible  Party:  For  spills,  check  to  indicate  the  party  responsible  for  the  release. 

3.  Layer  Completeness:  For  each  layer,  circle  yes  if  you  believe  all  causal  factors  that 
contributed  to  the  event  were  identified  as  a  result  of  the  inquiry.  Circle  no  if  you  believe 
other  causal  factors  could  have  been  identified  had  you  been  able  to  get  more  information 
during  the  inquiry. 

4.  Updated  Substance:  If  the  product  determined  to  be  involved  in  the  event  changes  over 
the  course  of  the  inquiry,  note  the  change  here. 

5.  Quantity:  enter  the  final  estimate  of  the  amount  of  product  spilled. 

6.  Date:  Enter  the  date  the  FIFACS  EVENT  DATA  FORM  is  completed. 

7.  Notes  (Outside  Influences;  recommendations):  If  groups  outside  the  terminal-vessel 
organizations  contributed  to  the  event,  note  it  here.  Examples  of  outside  influences  include 
government  agencies,  local  public  political  pressure  and  economic  pressures.  Also,  specific 
comments  about  the  event,  or  recommendations  that  result  from  the  inquiry  should  be 
added  here. 
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Appendix  F  STOLT-NIELSEN  ACCIDENT/INCIDENT  INVESTIGATION 


LOCATION  ONBOARD: 


LOSS  DESCRIPTION:  (check  all  applicable) 

_ DAMAGE 

_  Property  Damage 

_  System/Equipment  Damage 

_  Cargo  Loss/Damage/Contamination 

_  Ship  Damage 

_ POLLUTION 

_  Contained 

_ Water  Pollution 

_ Air  Pollution 

_ Personnel  Exposure 

_ GROUNDING 

_ OTHER  (describe):, _ 


DESCRIPTION  OF  THE  EVENT 


IMMEDIATE  CAUSES:  (What  substandard  actions  and  conditions  caused  or  could  cause  the 
event?) 


UNDERLYING  CAUSES:  (What  specific  personal  or  job  factors  caused  or  could  cause  the  event?) 


REMEDIAL  ACTIONS/RECOMMENDED  CHANGES:  (To  control  the  causes  listed) 


Rev  9/9/99 

(Cont’d...) 
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LOSS  SEVERITY:  (check) 

_  Major  _ Serious  _ Minor 


PROBABILITY  OF  OCCURRENCE:  (check) 
_ Frequent  _ Occasional  _ Seldom 


INJURY 

_  Death 

_  Serious 

_  Minor 

,  ADMINISTRATIVE 

_ Operational  Delay 

Regulatory  Violation 

_  Inspection  Deficiency 

FIRE/EXPLOSION 

COLLISION 

PIRACY/THEFT 


DATE,  TIME  &  PLACE  OF  INCIDENT:  CONT 
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RESPONSIBILITY  (For  remedial  action/changes): 


CODING  OF  IMMEDIATE  CAUSES:  (check  all  applicable) 


SUBSTANDARD  ACTIONS: 

SUBSTANDARD  CONDITIONS: 

_ 1 .  Operating  equipment  without  authority 

_ 1 .  Inadequate  guards  or  barriers 

_ 2.  Failure  to  warn 

_ 2.  Inadequate  or  improper  protective  equipment 

_ 3.  Failure  to  secure 

_ 3.  Defective  tools,  equipment  or  materials 

_ 4.  Operating  at  improper  speed 

_ 4.  Congestion  or  restricted  action 

_ 5.  Making  safety  devices  inoperable 

_ 5.  Inadequate  warning  systems 

_ 6.  Removing  safety  devices 

_ 6.  Fire  or  explosion  hazards 

_ 7.  Using  defective  equipment 

_ 7.  Poor  housekeeping;  disorder 

_ 8.  Using  equipment  improperly 

_ 8.  Hazardous  environmental  conditions 

_ 9.  Failing  to  use  proper  personal  protective 

_ 9.  Noise  exposure 

equipment 

_ 10.  Radiation  exposure 

_ 10.  Improper  loading 

_ 1 1 .  High/low  temperature  exposure 

_ 1 1 .  Improper  placement 

_ 12.  Inadequate  or  excess  illumination 

_ 12.  Improper  lifting 

_ 13.  Inadequate  ventilation 

_ 1 3.  Improper  position  for  task 

_ 14.  Installation  failure 

_ 14.  Servicing  equipment  in  operation 

_ 15.  Equipment  failure 

_ 15.  Horseplay 

_ 16.  System  failure 

_ 16.  Drugs/Alcohol 

_ 17.  Fatigue 

_ 18.  Procedural  error 

CODING  OF  UNDERL  YING  CAUSE:  (check  all  applicable) 


PERSONAL  FACTORS: 

JOB  FACTORS: 

_ 1 .  Fatigue 

_ 1 .  Inadequate  Leadership/Supervision 

_ 2.  Inadequate  capability 

_ 2.  Inadequate  Personnel 

_ 3.  Lack  of  knowledge 

_ 3.  Inadequate  Engineering 

_ 4.  Lack  of  skill 

_ 4.  Inadequate  Maintenance 

_ 5.  Stress 

_ 5.  Inadequate  Tools/Equipment 

_ 6.  Improper  motivation 

_ 6.  Inadequate  Work  Standards 

_ 7.  Wear  and  Tear 

_ 8.  Abuse  or  Misuse 

SUBMITTED  BY  (print  name):  _  DATE  OF  REPORT: 

SAFETY  COORDINATOR  SIGNATURE:  _ 

SHIPS  CAPTAIN  CONCURRENCE: _ 

FLEET  MANAGERS  APPROVAL:  _ 


(Please  provide  any  additional  comments  on  additional  sheets  and  attach.) 
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Appendix  G.  Sample  Taxonomies  for  Investigating  for  Fatigue, 
Communications  Problems,  and  Inadequate  Skills  and  Knowledge 

The  U.S.  Coast  Guard  Research  and  Development  Center  has  performed  three  studies  of  the 
roles  of  specific  human  errors  in  marine  casualties:  fatigue,  communications  problems,  and 
inadequate  skills  and  knowledge.  These  studies  focused  on  “critical”  casualties,  that  is, 
casualties  which  resulted  in  significant  damage  to  the  vessel,  cargo,  or  the  environment,  or 
which  resulted  in  significant  injury  to  personnel. 

The  first  two  pages  (following  this  introduction)  represent  data  that  were  found  useful  for 
determining  whether  or  not  fatigue  played  a  role  in  the  incident  (McCallum,  Raby,  &  Rothblum, 
1996).  Earlier  studies  (Marine  Transportation  Research  Board,  1976;  National  Research 
Council,  1990)  had  found  fatigue  to  be  the  “number  one”  concern  of  mariners.  This  study 
corroborated  that  concern,  finding  that  fatigue  played  a  role  in  16%  of  critical  vessel  casualties 
(groundings,  collisions,  allisions,  etc.)  and  in  33%  of  critical  personnel  injuries  (lacerations, 
amputations,  crushings,  etc.).  The  types  of  data  reflected  in  the  Fatigue  Information  form  focus 
on  scientifically  validated  causes,  symptoms,  and  effects  of  fatigue.  This  form  is  recommended 
for  use  by  organizations  interested  in  controlling  crew  fatigue  and  reducing  the  casualties 
fatigue  can  cause. 

As  mentioned  in  Section  6  in  the  discussion  of  statistical  analysis,  the  data  from  the  fatigue 
investigations  were  submitted  to  a  multiple  regression  analysis.  The  analysis  showed  that  the 
Coast  Guard  could  significantly  streamline  its  initial  investigation  of  fatigue  to  just  three 
questions:  how  many  hours  did  the  person  sleep  during  the  24-hour  period  prior  to  the  casualty; 
how  many  hours  did  the  person  work  during  the  24-hour  period  prior  to  the  casualty;  and  how 
many  fatigue  symptoms  did  the  person  experience  while  on  duty  prior  to  the  casualty?  The 
answers  to  these  questions  are  put  into  an  equation,  as  shown  on  the  Fatigue  Investigations 
Worksheet  (third  page  of  this  Appendix),  and  the  result  was  found  to  correctly  identify  whether 
fatigue  was  a  causal  factor  in  80%  of  the  cases.  Please  note  that  the  Fatigue  Index  Score  is 
offered  only  as  an  example  of  the  use  of  statistical  analysis  of  incident  data,  and  it  is  not 
recommended  for  use  by  anyone  other  than  the  Coast  Guard.  The  selection  and  weightings  of 
the  variables  in  the  Fatigue  Index  equation  may  well  reflect  the  somewhat  guarded  atmosphere 
of  a  USCG  investigation  (i.e.,  since  one’s  license  could  be  on  the  line,  one  is  less  likely  to  be 
open  and  forthright  about  one’s  condition  and  everything  that  occurred).  We  would  anticipate 
that  in  the  “open,  blame-free  culture”  recommended  for  safety-conscious  companies,  a  very 
different  set  of  weighting  factors  (and  maybe  a  different  set  of  variables  altogether)  would  apply. 
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Inadequate  communications  was  found  to  play  a  role  in  18%  of  critical  vessel  casualties  and  in 
28%  of  critical  personnel  injuries  (McCallum,  Raby,  Rothblum,  Forsythe,  Slavish,  &  Smith,  2000, 
unpublished).  The  communications  investigation  procedures  provided  in  this  appendix  are 
based  on  a  scientific  model  of  communications  (described  in  the  Instructions  for  Investigating 
Communications  Problems  in  Marine  Casualties).  The  gist  of  the  procedure  is  to  identify  under 
what  types  of  situations  communication  is  normally  required  -  a  list  that  can  easily  be  modified 
to  suit  any  company’s  operations  -  then  to  determine  whether  necessary  communications  were 
absent  or  ineffective  and  why.  As  described  in  Section  6,  this  investigation  protocol  was  not 
only  sufficient  to  identify  casualties  in  which  inadequate  communications  were  a  contributing 
cause,  it  also  supported  a  meta-analysis  to  illuminate  underlying  causes  of  the  communications 
failures.  In  addition,  it  was  found  that  the  five  screening  questions  (Step  1  on  the 
communications  investigation  form)  captured  76%  of  the  casualties  in  which  communications 
errors  were  involved,  making  it  a  simple  and  effective  way  to  determine  whether  the  complete 
communications  investigation  needs  to  be  performed. 

The  final  set  of  investigation  forms  assess  whether  skill  and  knowledge  limitations  may  have 
contributed  to  the  incident.  A  study  of  skill  and  knowledge  errors  showed  that  they  played  a  role 
in  22%  of  critical  vessel  casualties  and  in  32%  of  critical  personnel  injuries  (McCallum, 
Forsythe,  Raby,  Barnes,  Rothblum,  &  Smith,  2000,  unpublished).  Step  4  of  the  Mariner  Skill  & 
Knowledge  Limitations  Investigation  Screening  form  essentially  seeks  to  distinguish  errors  of 
knowledge  and  skilled  performance  (Decision  Errors  in  FIFACS)  from  slips  and  lapses  (Skill- 
based  and  Perceptual  errors  in  FIFACS)  and  from  violations.  If  it  appears  that  the  individual  did 
not  intentionally  break  a  rule  (violation)  and  failed  to  perform  an  action  properly  given  an  honest 
effort,  it  is  assumed  that  a  lack  of  knowledge  or  skill  is  the  cause.  The  remainder  of  the  skill 
and  knowledge  forms  provide  lists  of  common  skill  and  knowledge  areas  relevant  to  different 
types  of  activities  (bridge,  deck,  engineering,  and  safety  &  emergency  operations)  -  obviously, 
these  forms  can  be  modified  to  suit  any  type  of  operation.  The  crux  of  the  forms  is  to  identify 
the  type  of  error  (skill  or  knowledge  that  was  lacking)  and  to  determine  whether  the  error 
resulted  from  a  lack  of  training/experience  on  the  part  of  the  person  or  from  a  poorly  designed 
standard  operating  procedure  (SOP)  or  policy.  Note  that  while  this  analysis  will  determine 
whether  insufficient  training,  experience,  or  a  poor  SOP  was  a  contributing  cause,  that  the  best 
solution  to  such  problems  may  turn  out  to  be  other  types  of  interventions,  such  as  a  redesign  of 
equipment,  tasks,  or  work  environment  (see  Sec.  8). 
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Fatigue  Investigation  Form 

Form  should  be  completed  for  each  individual  who  was  directly  linked  to  the  casualty. 

Section  1 :  Casualty  Day 


1.  Experience  of  involved  individual 


year(s) 


month(s) 


a)  in  the  industry 

b)  with  this  company 

c)  in  present  job  or  position 

d)  on  present  vessel 


2.  Individual’s  activity  at  time  of  casualty 


3.  Specific  location  on  vessel 


4.  Number  of  hours  on  duty  at  time  of  casualty 


Any  break  (awake)  prior  to  casualty? 


□  No  break 

□  Yes,  when 


6.  Time  and  last  meal  (breakfast,  lunch,  dinner)  taken  prior 
to  casualty 


Was  the  schedule  on  day  of  casualty  different  from  usual? 
□  No  □ 

a.  What  was  the  difference? _ 

b.  How  long  had  you  been  on  this  schedule? _ 


Yes 


8.  Did  you  experience  any  of  these  factors  during  the  last  24  hours  prior  to  the  casualty?  [Check  all  that  apply.) 

□  Boredom 


□  Disruptive  ship  vibrations 

□  Disruptive  ship  motion 

□  High  noise  level 


□  Stormy  weather 

□  Cold  temperature 

□  Hot  temperature 


□  High  stress 

□ 

□  Demanding  task 


□ 

Other 


None 


Did  you  experience  any  of  the  following  while  you  were  on  duty 

□  Forgetful 

□  Difficulty  keeping  eyes  opened 

□  Difficulty  operating  equipment 

□  Sore  muscles 

□  Desire  to  sit  or  lay  down 


prior  to  the  casualty?  (Check  all  that  apply.) 

□  Distracted 

□  Less  motivated 

□  None 

□  Other _ 


Section  2:  Working  Scheduie 


10.  Number  of  days  on  tour  at  time  of  casualty  (including  shipyard) 

1 1 .  Please  shade  the  days  on  which  you  had  24  hours  off  in  the  previous  30  days 

30  29  28  27  26  25  24  23  22  21  20  19  18  17  16  15  14  13  12  11  10  9  8  7  6  5  4  3  2 


Day  of 
Casualty 


(over) 
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Fatigue  Information  -  Side  2 


12. 


Normal 

Schedule 


Work 

Rec 

Sleep 


0000  0200 
midnight 


1  200 
noon 


1400 
2  pm 


1  600  1  800  2000  2200 

4  pm  6  pm  8  pm  1 0  pm 


very  very 

low  high 

1  2  3  4  5 
Workload  level  □  □  □  □  □ 
Fatigue  level  □  □  □  □  □ 

Sleep  quality  □  □  □  □  □ 


From  the  time  of  casualty,  trace  back  the  work,  recreation,  and  sleep  periods  for  the  last  72  hours  (3  days)  prior  to  the 
casualty.  Sleep  also  includes  naps.  Please  mark  time  of  casualty  with  vertical  line. 


13. 

Day  of 
Casualty 

Work 

Rec 

Sleep 

00 
m  id  r 

59 

very  very 

low  high 

1  2  3  4  5 

Workload  level  □  □  □  □  □ 
Fatigue  level  □  □  □  □  □ 

Sleep  quality  □  □  □  □  □ 

00 

light 

02 

00 

0^ 

1 

iOO 

Of 

)00 

Of 

?00 

1  0 

00 

1  2 

no 

00 

0  n 

1  4 

2 

00 

pm 

1  6 
4 

00 

pm 

1  8 
6  . 

00 

pm 

20 
8  1 

00 

3m 

22 

10 

00 

pm 

23 

14. 

Day  1 

Prior  to 
Casualty 

Work 

Rec 

Sleep 

00 
m  id  r 

59 

very  very 

low  high 

1  2  3  4  5 

Workload  level  □  □  □  □  □ 

Fatigue  level  □  □  □  □  □ 

Sleep  quality  □  □  □  □  □ 

00 

light 

02 

00 

0^ 

1 

iOO 

Of 

)00 

Of 

?00 

1  0 

00 

1  2 

no 

00 

0  n 

1  4 

2 

00 

pm 

1  6 
4 

00 

pm 

1  8 
6 

00 

pm 

20 
8  1 

00 

3m 

22 

10 

00 

pm 

23 

15. 

Day  2 

Prior  to 
Casualty 

Work 

Rec 

Sleep 

00 
m  id  r 

59 

very  very 

low  high 

1  2  3  4  5 

Workload  level  □  □  □  □  □ 
Fatigue  level  □  □  □  □  □ 

Sleep  quality  □  □  □  □  □ 

00 

light 

02 

00 

0^ 

1 

iOO 

Of 

)00 

Of 

?00 

1  0 

00 

1  2 

no 

00 

0  n 

1  4 

2 

00 

pm 

1  6 
4 

00 

pm 

1  8 
6  . 

00 

pm 

20 
8  1 

00 

3m 

22 

10 

00 

pm 

23 

16. 

Day  3 
Prior  to 
Casualty 

very  very 

low  high 

1  2  3  4  5 

Workload  level  □  □  □  □  □ 

Fatigue  level  □  □  □  □  □ 

Sleep  quality  □  □  □  □  □ 

Work 

Rec 

Sleep 

00 
m  id  r 

59 

00 

light 

02 

00 

0^ 

1 

iOO 

Of 

)00 

Of 

500 

1  0 

00 

1  2 

no 

00 

0  n 

1  4 

2 

00 

pm 

1  6 
4 

00 

pm 

1  8 
6  : 

00 

pm 

20 
8  1 

00 

3m 

22 

10 

00 

pm 

23 

17.  Are  there  any  company  or  union  policies  regarding  work 
hour  limits? 

□  No  □  Yes  Maximum  hours: 

18.  In  the  involved  individual’s  opinion,  was  fatigue  a  contributing  factor  to  this 
casualty? 

□  No  □  Yes  Why: 

Section  3:  For  the  Investigator  Only 


1 9.  What  was  the  decision/action  that  was  c 

□  Failure  to  secure  equipment 

□  Failure  to  notice  something 
important 

□  Failure  to  take  action  at  proper 
time 

onsidered  improper  given  the  existing  circur 

□  Failure  to  recognize  code/symbol 

□  Failure  to  decide  on  an  action 

□  Forgetting  to  accomplish  task 

□  Prone  to  take  risks 

n  stances? 

□  Erroneous  judgment  of  situation 

□  Erroneous  calculations 

□  Improper  procedures 

□  Slow  reaction  to  circumstance 

□  Other 

20.  a)  Was  alcohol/drug  testing  done?  □  Yes  □  No 

b)Was  the  result:  □  Positive  □  Negative  □  No  result 

21 .  In  your  opinion,  was  fatigue  a  contributing  factor  to  this  casualty? 

□  No  DYes  Whv 

22.  On  a  scale  of  1  to  5,  do  you  feel  that  the  mariner  gave  you  true 
and  accurate  information? 

□  □  □  □  □ 

1  2  3  4  5 

not  at  all  extremely 

true  &  accurate  true  &  accurate 

Additional  Comments 
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FATIGUE  INVESTIGATION  WORKSHEET 

The  formula  s(21.4)  +  wh(6.1)  -  sh(4.5)  =  Fatigue  Index  Score  has  been  established  to 
determine  if  fatigue  may  have  affected  an  individual  involved  in  a  marine  casualty.  It  should 
only  be  used  for  examining  cases  in  which  direct  human  error  contributions  are  present,  i.e., 
those  situations  which  involve  an  individual’s  decisions,  actions  or  inactions  as  casual  factors 
occurring  immediately  before  the  casualty. 

Using  the  Formula 

s(21.4)  +  wh(6.1)  -  sh(4.5)  =  Fatigue  Index  Score 

s  =  total  number  of  fatigue  symptoms  (0-7)  experienced  while  on  duty  before  the  casualty 
wh  =  total  number  of  hours  worked  in  the  last  24  hours  (to  the  nearest  tenth) 
sh  =  total  number  of  hours  slept  in  the  last  24  hours  (to  the  nearest  tenth) 

1 .  Interview  the  individual  whose  errors  directly  contributed  to  the  casualty  (or  another  person 
who  can  verify  the  information)  to  determine  the  total  number  of  fatigue  symptoms  (s)  listed 
below,  if  any,  that  the  individual  experienced  while  on  duty  prior  to  the  casualty. 

Fatigue  Symptoms  (s) 

-  forgetful  -  desire  to  sit  or  lay  down 

-  distracted  -  difficulty  keeping  eyes  opened 

-  sore  muscles  -  difficulty  operating  equipment 

-  less  motivated 

2.  Obtain  the  individual’s  total  work  hours  {wh)  and  sleep  hours  {sh)  for  the  24  hour  period 
before  the  casualty.  Determine  the  Fatigue  Index  Score  using  the  formula. 

3.  If  the  Fatigue  Index  Score  is  greater  than  50,  assume  that  fatigue  was  a  contributing  cause 
of  the  casualty.  Our  research  has  shown  that  this  formula  will  produce  correct  results  80%  of 
the  time. 

Example:  At  0130,  the  F/V  SEA  MONKEY  ran  aground  while  returning  to  port.  The  mate  on 
watch  reported  that  he  had  slept  3.2  hours  and  worked  18.6  hours  in  the  24  hours  preceding  the 
casualty.  Fie  also  said  that  while  on  watch  before  the  casualty,  he  had  difficulty  keeping  his 
eyes  opened  and  felt  distracted.  The  equation  for  this  casualty  would  then  read: 

s(21 .4)  +  wh(6.1)  -  sh(4.5)  =  Fatigue  Index  Score 

2(21.4)  +  18.6(6.1)  -  3. 2(4. 5)  =  Fatigue  Index  Score 

141 .9  =  Fatigue  Index  Score 

Since  the  results  are  greater  than  50,  fatigue  is  assumed  as  a  contributing  factor  to  the 
casualty. 
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Instructions  for  Investigating  Communications  Problems  in  Marine  Casualties 

These  instructions  provide  an  aid  in  using  the  Communications  Probiems  Screening  and  investigation  Procedures  to 
investigate  communications  probiems  in  vessei  and  personnel  injury  casualties. 

Background 

These  procedures  were  developed  as  part  of  a 
Coast  Guard  study  of  how  best  to  investigate  and 
report  on  communications  problems.  As  part  of 
that  study,  a  general  model  of  communications 
problems  was  developed,  shown  in  the  adjacent 
figure.  This  model  divides  communications  into 
four  Communications  Processes  (prepare  and 
send  message,  message  transmission,  receive 
and  interpret  message,  and  act  on  message)  and 
four  corresponding  Communications  Probiem 
Areas.  The  model  further  identifies  seven 
Contributing  Factor  Areas  that  can  cause  or 
contribute  to  communications  problems. 

Basis 

Investigation  procedures  based  on  this  model 
were  developed  and  then  applied  by  Investigating 
Officers  as  part  of  the  study.  During  the  study, 
investigators  screened  casualties  to  identify  those 
that  required  effective  communications  to  support 
safe  operations.  Of  those  casualties  identified  as 
requiring  effective  communications,  76  percent 
were  subsequently  found  to  have  a 
communications  problem  that  contributed  to  the 
casualty.  Following  their  initial  screening  of  cases,  investigators  conducted  in-depth  investigations  and  analyses  of 
selected  casualties  to  identify  specific  communications  problems  and  contributing  factors.  Investigating  Officers 
were  able  to  use  the  procedures  to  reliably  identify  communications  problem  areas  and  specific  factors  contributing 
to  the  casualties.  Overall,  the  study  found  that  18  percent  of  critical  vessel  casualties  and  28  percent  of  critical 
personnel  injuries  had  a  communications  problem  that  contributed  to  the  casualty. 

Instructions 

Step  1  is  conducted  to  identify  if  there  was  a  potential  for  a  communications  problem  to  have  contributed  to  the 
casualty.  This  step  identifies  casualties  where  there  is  a  76  percent  probability  that  ineffective,  inappropriate,  or  a 
lack  of  communications  contributed  to  the  casualty,  according  to  the  results  of  the  research  study. 

Step  1 :  Review  the  five  conditions,  check  any  that  apply,  and  identify  the  type(s)  of  communications  that  should  be 
further  analyzed  (vessel-vessel,  bridge-pilot,  vessel-shore  authority,  crew-crew,  and  vessel-shore  worker). 

The  remaining  steps  call  for  a  further  investigation  of  the  specific  communications  causes  that  contributed  to  the 
casualty.  Complete  Step  2  to  identify  the  specific  communications  causes,  if  any.  Complete  Step  3  to  document 
your  conclusions  regarding  the  type  of  communications  that  contributed  to  the  casualty.  Use  Step  4  as  an  aid  in 
investigating  and  reporting  any  communication  types  identified  in  Step  3. 

Step  2:  For  each  communication  type  identified  in  Step  1,  consider  the  actions  in  which  ineffective,  inappropriate, 
or  a  lack  of  needed  communications  could  have  contributed  to  the  casualty. 

Step  3:  Check  the  types  of  communications  that  likely  contributed  to  this  casualty  and  complete  Step  4  for  each 
type  checked. 

Step  4:  For  this  step,  it  will  typically  be  necessary  to  contact  individuals  involved  in  the  casualty  to  determine  the 
events  leading  up  to  the  casualty,  specific  communications  problems  that  occurred,  and  the  factors  that 
contributed  to  these  problems. 


Contributing  Factor  Areas 
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Communications  Problem  Screening  and  Investigation  Procedures 


Please  refer  to  the  Instructions  for  Investigating  Communications  Problems  in  Marine  Casualties  for  a 

summary  of  the  background  and  basis  for  these  procedures,  as  well  as  general  instructions  for  their  use. 

Step  1:  Was  there  a  potential  for  a  communications  problem  contributing  to  the  casualty? 

Review  the  following  casualty  conditions,  check  0  all  that  apply,  and  note  the  corresponding  communication 
type(s)  for  further  review  in  Step  2.  If  no  conditions  apply,  communications  were  likely  not  required  in  the 
situation. 


Casualty  Condition 

Communication  Type 

□ 

Two  or  more  vessels  were  involved  in  this  casualty. 

Vessel-Vessel 

□ 

There  was  a  pilot  (other  than  a  member  of  the  vessel’s  crew)  responsible  for 
navigation  of  the  ship. 

Bridge-Pilot 

□ 

The  vessel  was  navigating  in  an  area  under  the  supervision  of  a  VTS  operator, 
a  bridge  tender,  a  lockmaster,  or  a  light  operator. 

Vessel-Shore  Authority 

□ 

Two  or  more  crewmembers  who  were  directly  involved  in  this  casualty  were 
working  together,  or  this  casualty  could  have  been  prevented  if  someone  had 
shared  additional  information  with  another  crewmember. 

Crew-Crew 

□ 

The  casualty  occurred  during  coordination  of  activities  between  the  vessel  and 
shore-based  personnel  (e.g.,  dock  worker,  crane  operator,  or  vessel  agent). 

Vessel-Shore  Workers 

Step  2:  What  specific  communications  actions  contributed  to  the  casualty? 

Check  0  all  actions  in  which  ineffective,  inappropriate,  or  a  lack  of  needed  communications  may  have  contributed 
to  the  casualty.  Note  any  other  causes  not  listed.  If  any  potential  causes  are  identified,  continue  with  Steps  3  and 
4. 

Vessel-Vessel  Communication  Probiems 

□  Vessel  communication  using  a  VHF  radio  system  □  Vessel  communication  using  visual  signals 

□  Vessel  communication  using  sound  signals  □  Vessel  communication  using  some  other  means 

□  Other: . 

Bridge-Piiot  Communication  Problems 

□  Pilot  request  for  vessel  and  situation  information  □ 

□  Bridge  crew  warned  pilot  of  equipment  malfunction  □ 

□  Pilot  brief  to  bridge  crew  on  navigation  plan  □ 

□  Other: . 

Vessel-Shore  Authority  Communication  Probiems 

□  Vessel  call  to  shore  authority  □  Vessel  statement  of  intentions  to  shore  authority 

□  Shore  authority  advisory  to  vessel  of  situation  □  Shore  authority  acknowledgement  of  vsl 

□  Other:  intentions 

Crew-Crew  Communication  Problems 

□  Use  of  direct  and  verbal  conversation  □  Use  of  communications  devices 

□  Use  of  hand  signals  □  Use  of  written  communications 

. □ . Other: . 

Vessel-Shore  Worker  Communication  Probiems 

□  Use  of  direct  and  verbal  conversation  □  Use  of  communications  devices 

□  Use  of  hand  signals  □  Use  of  written  communications 

□  Other: 

No  Potential  Communication  Problems  Identified 

□  Further  investigation  failed  to  support  communications  as  a  causal  factor _ 


Pilot  brief  to  bridge  crew  on  operating  conditions 
Pilot  update  to  bridge  crew  on  change  in  plans 
Crew  update  to  pilot  of  change  in  situation 


Step  3:  Which  of  the  following  types  of  communication  contributed  to  this  casualty? 

Based  on  the  response  to  Step  2,  check  IZI  the  types  of  communication,  if  any,  that  likely  contributed  to  this 
casualty  and  complete  Step  4  for  each  type  checked. 
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□  Vessel-Vessel  Communications  □  Crew-Crew  Communications 

□  Bridge-Pilot  Communications  □  Vessel-Shore  Worker  Communications 

□  Vessel-Shore  Authority  Communications _ □  N/A-no  communication  problems  identified 


Step  4:  What  specific  communications  problems  and  factors  contributed  to  this  casualty? 

For  each  type  of  communication  checked  in  Step  3,  check  13  all  communications  problems  that  contributed  to  the 
casualty.  For  each  problem  identified  below,  list  at  least  one  contributing  factor  from  the  list  below  by  indicating 
its  corresponding  identification  number  (#1-41 ).  For  example,  3 Did  not  request  information... 3^  15 , 28. 


Communications  Process 

Communications  Problem 

Contributing  Factor 
(see  1-41  below) 

Prepare  &  Send  Message 

(includes  spoken  and 
written  communications, 
hand  and  sound  signals) 

□  Did  not  communicate . 

—  —  — 

□  Communicated  ambiguous,  incorrect,  or  incomplete  information . 

□  Did  not  question  others’  actions  or  assert  own  interpretation  of  situation  .. 

□  Did  not  request  information . 

□  Did  not  send  information  in  a  timely  manner  . 

□  Sent  different  information  than  intended . 

Message  Transmission 

□  Message  was  not  transmitted . 

□  Message  was  interrupted . 

—  —  — 

Receive  &  Interpret 

Message 

□  Did  not  monitor  communications  . 

□  Did  not  listen  to  complete  message . 

—  —  — 

□  Did  not  acknowledge  information  reception  . 

□  Did  not  interpret  the  information  correctly . 

□  Did  not  verify  the  validity  or  accuracy  of  the  information . 

-  -  - 

Act  on  Message 

□  Took  no  action . 

—  —  — 

□  Aotion  was  not  in  accordance  with  agreement . 

Others: 
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Knowledae  or  Experience 

Assumptions 

1 .  Improper  use  of  signaling  techniques  (hand,  light,  flag) 

22.  Assumed  that  there  was  no  need  to  communicate 

2.  Improper  use  of  standard  marine  technical  vocabulary 

23.  Assumed  lack  of  response  as  implicit  (silent)  confirmation 

3.  Inadequate  knowledge  of  company  procedures  or  policies 

24.  Assumed  incorrectly  that  other  party  knew  the  information 

4.  Inadequate  knowledge  of  correct  communications  protocol 

25.  Assumed  that  individual  in  charge  recognized  the  problem 

5.  Inadequate  knowledge  of  regulatory  requirements 

26.  Confusion  regarding  who  was  communicating 

6.  Limited  English  skills  or  knowledge 

27.  Confusion  regarding  who  was  in  charge  of  situation 

7.  Language  difficulty  (e.g.,  enunciation,  strong  accent) 

28.  Incorrect  interpretation  of  the  situation 

8.  Lack  of  common  language 

29.  Other: 

9.  Other: 

Environment 

Procedures 

30.  Excessive  ambient  noise 

10.  Did  not  carry  communications  equipment  on  person 

31 .  Excessive  electronic  or  atmospheric  disruption  of  signal 

11.  Did  not  operate  the  communications  equipment  correctly 

32.  Excessive  traffic  (i.e.,  too  many  users,  too  lengthy)  on  the 

12.  Selected  incorrect  communications  channel  or  frequency 

assigned  communications  channel 

13.  Selected  incorrect  communications  device 

33.  Other: 

14.  Other: 

Communications  Eauioment 

Performance 

34.  Communications  equipment  malfunction 

15.  Distracted  or  interrupted  by  other  tasks  (e.g.,  high  workload) 

35.  Communications  equipment  not  available 

16.  Forgot  information  or  intended  actions 

36.  Communications  equipment  turned  off 

17.  Tired  or  sleepy 

37.  Other: 

18.  Individual  not  at  work  station 

Manaaement  and  Government  Reaulations 

19.  Not  willing  to  challenge  authority 

38.  No  regulatory  requirement  to  communicate 

20.  Not  willing  to  communicate 

39.  Not  part  of  individual’s  job  description  or  responsibilities 

21.  Other: 

40.  Inadequate  Standard  Operating  Procedures 

41.  Other: 
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Communications  Reporting  Form 

Section  1.  Reference  Information 


1 .  Name  of  Investigator 

2.  Office 

3.  Case  Number 

4.  Vessel  Name 

Section  2.  Individuals  Contacted 


5.  Name  &  Job  Position  of  Individual 

Name 

6.  Individual  contacted 

By  phone  By  deposition 

In  person  Unable  to  contact 

7.  Individual’s  Fluency  in  English  Language 

a.  No  English  b.  Standard  maritime  phrases 

c.  Limited  conversation  d.  Fluent  e.  Unknown 

Job 

8.  Name  &  Job  Position  of  Individual 

Name 

9.  Individual  contacted 

By  phone  By  deposition 

In  person  Unable  to  contact 

10.  Individual’s  Fluency  in  English  Language 

a.  No  English  b.  Standard  maritime  phrases 

c.  Limited  conversation  d.  Fluent  e.  Unknown 

Job 

1 1 .  Name  &  Job  Position  of  Individual 

Name 

12.  Individual  contacted 

By  phone  By  deposition 

In  person  Unable  to  contact 

13.  Individual’s  Fluency  in  English  Language 

a.  No  English  b.  Standard  maritime  phrases 

c.  Limited  conversation  d.  Fluent  e.  Unknown 

Job 

Section  3.  Communications  Contribution 

This  form  relates  to  which  type  of  communications  problem?  (check  only  one  -  use  separate  form  for  eaoh  type) 

bridge-pilot  vessel-vessel  crew-crew  vessel-shore  workers  vessel-shore  authority 


14.  Were  communications  or  coordination  between  (the  groups  checked  above)  advisable  during  the  events  leading  up  to  the  casualty? 
Yes  No 

If  Yes,  briefly  describe  activities  (e.g.,  course  change,  passing,  line  handling,  cargo  transfer,  locking)  or  situation  requiring 
communications: 


15.  Describe  any  needed  communications  that  were  either  not  done  or  done  ineffectively. 


16.  In  the  Investigator’s  opinion,  were  communications  a  contributing  factor  to  this  casualty? 

Yes.  Describe  the  specific  type  of  communications  problems  checked  above  (i.e.,  Who?  What?  How?). 


No.  Indicate  the  apparent  cause(s)  of  the  casualty _ 

If  No  is  checked,  proceed  with  Section  4,  but  skip  Section  5  (Communications  Analysis),  otherwise  complete  both  sections  4  &  5. 


Section  4.  Conclusions  and  Comments 


17.  On  a  scale  of  1  to  5,  do  you  feel  that  the  individual( 

N/A  since  nobody  Individual  s  initials 

wa.<;  nnntantnd  Individual’s  initials 

Individual’s  initials 

s)  gave  you  true  and  accurate  information? 

Not  at  all  true  Extremely  true 

&  accurate  &  accurate 

1. 

1. 

1. 

2. 

2. 

2. 

3. 

3. 

3. 

4. 

4. 

4. 

5. 

5. 

5. 

1 8.  To  what  extent  was  there  a  discrepancy  in  th( 

N/A  since  only  1  individual  was 
contacted 

3  information  received  from  the  various  individuals  contacted? 

Complete  Complete 

disagreement  agreement 

1.  2.  3. 

4. 

5. 

19.  Safety  recommendations  to  prevent  similar  communications-related  casualties 

20.  Additional  Comments 
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Section  5.  Communications  Analysis 

Please  complete  this  section  if  bridge-pilot  communications  is  a  contributing  factor  to  this  casualty.  Check  0 all  bridge-pilot 
communications  process  problems  that  apply.  For  each  process  problem  identified,  list  at  least  one  contributing  faotor  from  the 
list  below  by  indicating  its  oorresponding  identification  number  (#1  -41 ).  (e.g.,  0 Did  not  request  information  _g_,  8 ,  11) _ 


21.  Process  Problems 

Contributing  Factors 

Communications  Process 

Process  Problems 

(see  1  -41  below) 

Prepare  &  Send  Message 

Did  not  communicate . 

(includes  spoken  and  written 

communications) 

Communicated  ambiguous,  incorrect,  or  incomplete  information . 

-  -  -  - 

Did  not  question  others'  actions  or  assert  own  interpretation  of  situation. 

-  -  -  - 

Did  not  request  information . 

Did  not  send  information  in  a  timely  manner . 

Sent  different  information  than  intended . 

Message  Transmission 

Message  was  not  transmitted . 

-  -  -  - 

Message  was  interrupted . 

—  —  —  — 

Message  was  incomprehensible 

-  -  -  - 

Receive  &  Interpret  Message 

Did  not  monitor  communications 

-  -  -  - 

Did  not  listen  to  complete  message . 

—  —  —  — 

Did  not  acknowledge  information  reception . 

-  -  -  - 

Did  not  interpret  the  information  correctly . 

Did  not  verify  the  validity  or  accuracy  of  the  information . 

Act  on  Message 

Took  no  action . 

—  —  —  — 

Action  was  not  in  accordance  with  agreement . 

—  —  —  — 

Others: 

—  —  —  — 

Contributing  Factors 

Knowledae  or  Experience 

Assumptions 

1 .  Improper  use  of  signaling  techniques  (hand,  light,  flag,  Morse) 

22.  Assumed  that  there  was  no  need  to  communicate 

2.  Improper  use  of  standard  marine  technical  vocabulary 

23.  Assumed  lack  of  response  as  implicit  (silent)  confirmation 

3.  Inadequate  knowledge  of  company  procedures  or  policies 

24.  Assumed  incorrectly  that  other  party  knew  the  information 

4.  Inadequate  knowledge  of  correct  communications  protocol 

25.  Assumed  that  individual  in  charge  recognized  the  problem 

5.  Inadequate  knowledge  of  regulatory  requirements 

26.  Confusion  regarding  who  was  communicating 

6.  Limited  English  skills  or  knowledge 

27.  Confusion  regarding  who  was  in  charge  of  situation 

7.  Language  difficulty  (e.g.,  enunciation,  strong  accent) 

28.  Incorrect  interpretation  of  the  situation 

8.  Lack  of  common  language 

29.  Other: 

9.  Other: 

Environment 

Procedures 

30.  Excessive  ambient  noise 

10.  Did  not  carry  communications  equipment  on  person 

31 .  Excessive  electronic  or  atmospheric  disruption  of  signal 

11.  Did  not  operate  the  communications  equipment  correctly 

32.  Excessive  traffic  (i.e.,  too  many 

users,  too  lengthy)  on  the 

12.  Selected  incorrect  communications  channel  or  frequency 

assigned  communications  channel 

13.  Selected  incorrect  communications  device 

33.  Other: 

14.  Other: 

Communications  Eauioment 

Performance 

34.  Communications  equipment  malfunction 

15.  Distracted  or  interrupted  by  other  tasks  (e.g.,  high  workload) 

35.  Communications  equipment  not  available 

16.  Forgot  information  or  intended  actions 

36.  Communications  equipment  turned  off 

17.  Tired  or  sleepy 

37.  Other: 

18.  Individual  not  at  work  station 

Manaaement  and  Government  Reaulations 

1 9.  Not  willing  to  challenge  authority 

38.  No  regulatory  requirement  to  communicate 

20.  Not  willing  to  communicate 

41 .  Not  part  of  individual’s  job  description  or  responsibilities 

21.  Other: 

42.  Inadequate  Standard  Operating  Procedures 

41.  Other: 
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Human  Factors  in  Incident  Investigation  and  Analysis 


Mariner  Skill  &  Knowledge  Limitations  Investigation  Screening 
Step  1:  Human  Factors  Involvement 

Did  at  least  one  person's  actions,  inaction,  or  decisions  directly  contributed  to  the  casualty  or  its  severity? 

□YES  -  Go  to  Step  2. 

□  NO  -  Human  factors  are  likely  not  involved  and  further  investigation  of  mariner  skill  and  knowledge  limitations  is  unwarranted. 


Step  2:  Contributing  Individuals 

List  the  names  and  job  positions  of  up  to  three  persons  whose  actions,  inaction,  or  decisions  most  directly  contributed  to  the 
casualty.  For  each  person,  identify  the  general  area(s)  of  vessel  operations  that  contributed  to  the  casualty,  then  go  to  Step  3. 


Mariner’s  Name 

Job  Position 

Vessei  Operations  Contributing  to  Casuaity 

(Bridge,  Deck,  Engineering,  Safety  &  Emergency) 

1. 

2. 

3. 

Step  3:  Contributing  Activities 

Briefly  describe  each  person 's  actions,  inaction,  and/or  decisions  that  contributed  to  the  casualty. 


Step  4:  Potential  for  Skill  and  Knowledge  Limitations 


For  each  mariner,  respond  to  the  following  questions.  If  possible,  interview  the 
mariner(s)  in-person  or  by  telephone  to  address  these  questions. 

Mariner  1 

Mariner  2 

Mariner  3 

a.  Did  this  person’s  action  or  inaction  result  in  their  knowing  violation  of  an  applicable 
law,  rule,  policy  or  standard  operating  procedure? 

if  NO  for  any  involved  mariner,  go  to  b. 

If  YES  for  all  Involved  mariners,  end  report.  This  casualty  is  likely  a  violation,  not 
the  result  of  skill  and  knowledge  limitations. 

□YES 

□  NO 

□  YES 

□  NO 

□  YES 

□  NO 

b.  Has  each  person  successfully  demonstrated  the  contributing  activities  many  times 
before  under  similar  circumstances  and  within  the  last  five  years? 

If  NO  for  any  involved  mariner,  go  to  Step  5. 

If  YES  for  all  Involved  mariners,  end  report.  This  casualty  Is  likely  either  a  slip  or  a 
lapse,  not  the  result  of  skill  and  knowledge  limitations. 

□YES 

□  NO 

□  YES 

□  NO 

□  YES 

□  NO 

Step  5:  Completion  of  Operations  Form(s) 

Complete  applicable  operational  area  investigation  form(s)  for  Bridge,  Deck,  Engineering,  and/or  Safety  & 
Emergency  Operations,  for  each  mariner  with  NO  answers  to  Questions  4a  and  4b. 
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Bridge  Operations  -  Mariner  Skill  &  Knowledge  Limitations 

Please  complete  a  separate  copy  of  this  form  for  each  person  whose  bridge  activities  contributed  to  the  casualty. 

Step  5.1:  Maritime  Work  History  of  Contributing  Mariner _ 


1.  Mariner’s  name: 

2.  Job  position  at  time  of  casualty: 

3.  years  months  in  this  industry. 

4.  years  months  with  this  company. 

5.  years  months  in  present  oosition. 

6.  years  months  on  present  vessel  or  facility. 

7.  years  months  on  present  route. 

8.  Current  licenses/documents  (N/A  if  not  applicable): 

Step  5.2:  Mariner’s  Actions,  Inaction,  or  Decisions  Contributing  to  the  Casualty 


9.  Briefly  describe  how  this  person’s  specific  bridge  actions,  inaction,  or  decisions  contributed  to  the  casualty: 


Now,  check  IZI  all  bridge  activities  (10-17)  that  directly  contributed  to  the  casualty. 


10.  Did  changing  bridge  watch  activities  contribute? 

□  a.  Check  and  acknowledge  passage  plan,  orders,  and 

special  information 

□  b.  Assess  traffic  and  weather  conditions _ 

11.  Did  visual  monitoring  and  lookout  activities  contribute? 

□  a.  Instruct  Lookout  as  to  duties  and  ensure  Lookout  is 

prepared  to  assume  the  watch 

□  b.  Maintain  lookout  to  detect  objects,  traffic,  or 

_ navigational  aids  and  assess  visibility _ 

12.  Did  collision  avoidance  activities  contribute? 

□  a.  Adjust  and  operate  radar/ARPA 

□  b.  Monitor  radar/ARPA  and  radar  contacts 

13.  Did  grounding  avoidance  and  navigation  contribute? 

□  a.  Establish  a  passage  plan  based  on  navigation 

information  and  knowledge  of  are 

□  b  Determine  vessel  position  using  available  systems 

14.  Did  shiphandling  activilies  contribute? 

□  a.  Maneuver  in  accordance  with  sea/river/weather 

conditions 

□  b.  Maneuver  in  accordance  with  vessel  and/or  tow 

handling  characteristics 

15.  Did  bridge  communications  contribute? 

□  a.  Communicate  and  coordinate  effectively  among  the 

vessel’s  crew  (Bridge,  Engine,  and  Deck) 

□  b.  Communicate  and  coordinate  between  the  bridge 

_ watch  team  and  the  federal/state  pilot _ 

16.  Did  port  or  anchor  watch  activities  contribute? 

□  a.  Inspect  for  leaks,  loose  or  weak  mooring  lines,  and 

_ smoke  or  fire _ 

17.  Did  a  bridge  activity  not  listed  above  contribute? 


□  YES  Check  all  activities  that  apply.  □  NO  Go  to  1 1. 

□  c.  Check  status  of  ship’s  equipment 

□  d.  Ensure  that  watch  is  relieved 


□  YES  Check  all  activities  that  apply.  □  NO  Go  to  12. 

□  c.  Determine  type,  aspect,  and  relative  motion  of  other 

vessels 

□  d.  Receive  and  verify  reports  of  visual  contact 

□  YES  Check  all  activities  that  apply.  □  NO  Go  to  13. 

□  c.  Assess  collision  threat  and  determine  avoidance 

maneuver 

□  d.  Recognize  and  apply  COLREGS _ 

□  YES  Check  all  activities  that  apply.  □  NO  Go  to  14. 

□  c.  Calculate  course  changes  based  on  navigation 

information,  local  conditions,  and  local  regulation 

□  d.  Check  and  update  navigation  charts  and  publications 

□  YES  Check  all  activities  that  apply.  □  NO  Goto  15. 

□  c.  Maneuver  vessel  in  accordance  with  conning  orders 

□  d.  Maneuver  vessel  during  docking,  anchoring,  and 

mooring 

□  e.  Manage  and  coordinate  assist  vessels _ 

□  YES  Check  all  activities  that  apply.  □NO  Go  to  16. 

□  c.  Interpret  and  reply  to  signals  (flag  signals,  flashing 

light,  and  ship’s  whistle) 

□  d.  Establish  and  maintain  VHP  radio  communications  with 

_ other  vessels  and  appropriate  shore  authorities _ 

□  YES  Check  all  activities  that  apply.  □NO  Goto  17. 

□  b.  Monitor  vessel  position  to  determine  if  anchor  is 

_ dragging _ 

□  YES  Briefly  describe  activity  below.  □NO  Goto  18. 
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Human  Factors  in  Incident  Investigation  and  Analysis 
(Bridge  Operations  -  Mariner  Skill  &  Knowledge  Limitations,  cont.) 

Step  5.3:  Training  and  Procedures 

Write  the  identification  numbers  of  up  to  three  bridge  activities  checked  in  Step  5.2  that  most  contributed  to  the 
casuaity.  (Exampte:  Activity  1: 10a.  Activity  2:  13b.  Activity  3:  16a.}  Then,  complete  the  remaining  items  under  each 
listed  activity. _ 


18.  Activity  1: 

23.  Activity  2: 

28.  Activity  3: 

19.  What  training  has  the  mariner  had  to 
prepare  for  Activity  1  ? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

24.  What  training  has  the  mariner  had  to 
prepare  for  Activity  2? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

29.  What  training  has  the  mariner  had 
to  prepare  for  Activity  3? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

□  Other  training 

□  Other  training 

□  Other  training 

20.  Briefly  describe  the  mariner’s  most 

25.  Briefly  describe  the  mariner’s  most 

30.  Briefly  describe  the  mariner’s  most 

relevant  training  for  Activity  1. 

relevant  training  for  Activity  2. 

relevant  training  for  Activity  3. 

21 .  How  long  has  it  been  since  the 
mariner  received  this  Activity  1 
training? 

years  and  months 

26.  How  long  has  it  been  since  the 
mariner  received  this  Activity  2 
training? 

years  and  months 

31 .  How  long  has  it  been  since  the 
mariner  received  this  Activity  3 
training? 

years  and  months 

22.  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  1 . 

27.  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  2. 

32.  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  3. 

Are  procedures  adequate?  DYES  DNO 

Are  procedures  adequate?  DYES  DNO 

Are  procedures  adequate?  DYES  DNO 

Step  5.4:  Conclusions  and  Recommendations 

Respond  to  items  33-34  after  completing  Step  5.3. 
33.  If  the  mariner  lacks  skill  or  knowledge  in  any  activity 


(1  to  3),  complete  33  and  34;  otherwise,  end  this 
report  (NOT  skill  or  knowledge  related). 

Activity  1 

Activity  2 

Activity  3 

a.  The  mariner  most  likely  lacks  skill  in  this 
activity. 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

b.  The  mariner  most  likely  lacks  knowledge  in 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

this  activity. 

34.  What  could  be  done  to  improve  this  mariner’s  skill  and/or  knowledge,  or  to  improve  established  procedures  and  reduce 
casualties? 

Minimum: 


Ideal: 
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Human  Factors  in  Incident  Investigation  and  Analysis 


Deck  Operations  -  Mariner  Skill  &  Knowledge  Limitations 

Step  5.1:  Maritime  Work  History  of  Contributing  Mariner _ 


1.  Mariner’s  name: 

2.  Job  position  at  time  of  casuaity: 

3.  years  months  in  this  industry. 

4.  years  months  with  this  company. 

5.  years  months  in  present  position. 

6.  years  months  on  present  yessei  or  faciiity. 

7.  years  months  on  present  route. 

8.  Current  iicenses/documents  (N/A  if  not  appiicabie): 

Step  5.2:  Mariner’s  Actions,  Inaction,  or  Decisions  Contributing  to  the  Casualty 


9.  Briefiy  describe  how  this  person’s  specific  deck  actions,  inaction,  or  decisions  contributed  to  the  casuaity: 

Now,  check  IZI  all  deck  activities  (10-21) )  that  directly  contributed  to  the  casualty. 

to.  Did  vessel  stability  and  integrity  management  actiyities 
contribute? 

□  a.  Load  and  unload  a  yessei  taking  into  account  load 
lines,  stability,  trim,  and  stress  principles  and 
calculations 

□  YES 

□  b. 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Go  to  1 1. 

Adjust  ballast  as  required  to  maintain  stability 

Operate  vessel  in  compliance  with  Stability  Letter 

Ensure  vessel’s  water  tight  integrity 

11.  Did  deck  equipment  operations  actiyities  contribute? 

□  a.  Board  pilot 

□  b.  Conduct  docking,  anchoring,  and  mooring  operations 

□  YES 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Go  to  12. 

Assist  in  tug/escort  vessel  tie-up  operations 

Prepare  and  stow  cargo  handling  equipment 

12.  Did  container  cargo  operations  activities  contribute? 

□  a.  Establish  container  stowage  plan 

□  b.  Load  and  unload  containers 

□  YES 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Goto  13. 

Lash  all  containers 

Monitor  and  maintain  cargo  security 

13.  Did  buik  cargo  operations  contribute? 

□  a.  Establish  bulk  cargo  loading  plan 

□  b.  Load  and  unload  bulk  cargo 

□  YES 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Go  to  14. 

Monitor  and  maintain  cargo  security 

Handle  dangerous  and  hazardous  cargo 

14.  Did  petroleum  cargo  activities  contribute? 

□  a.  Operate  pumping  equipment 

□  b.  Monitor  piping  and  pumping  systems 

□  YES 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Goto  15. 

Clean  petroleum  cargo  tanks 

Conduct  inert  gas  and  gas-free  operations 

15.  Did  towing  and  fleeting  operations  contribute? 

□  a.  Establish  a  tow  diagram 

□  b.  Make  up,  check,  and  tighten  towlines  and  headwires 

□  YES 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Goto  16. 

Check  tow  for  water  and  pump  barges 

Conduct  locking  and  lock  assist  operations 

16.  Did  fishing  operations  activities  contribute? 

□  a.  Set,  retrieve,  and  handle  fishing  gear 

□  b.  Bring  aboard  and  load  catch 

□  YES 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Goto  17. 

Unload  or  transfer  catch 

Process  catch 

17.  Did  deck  communications  activities  contribute? 

□  a.  Communicate  effectively  between  deck  and  bridge 

□  b.  Communicate  effectively  among  deck  crew 

□  YES 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Goto  18. 
Coordinate  between  deck  and  assist  vessels 

Coordinate  between  deck  and  dock  crew 

18.  Did  deck  maintenance  activities  contribute? 

□  a.  Perform  deck,  hull,  and  surface  chipping,  painting 

□  b.  Maintain  deck  equipment 

□  YES 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Go  to  19. 

Work  in  confined  spaces 

Perform  hot  work 

19.  Did  general  activities  on  deck  activities  contribute? 

□  a.  Embarking  or  disembarking  vessel 

□  b.  Moving  around  the  vessel 

□  YES 

□  c. 

Check  all  activities  that  apply.  □  NO  Go  to  20. 

General  off-duty  activities  onboard  vessel 

20.  Did  passenger  safety  activities  contribute? 

□  a.  Ensure  the  safety  of  passengers  during  embarkation 

and  disembarkation 

□  b.  Ensure  the  safety  of  passengers  when  underway  and 

during  ship  operations 

□  YES 

□  c. 

□  d. 

Check  all  activities  that  apply.  □  NO  Go  to  21. 

Inspect  passenger  spaces  for  hazards  and  take 
appropriate  action 

Confine  passenger  access  to  safe  vessel  spaces  only 

21 .  Did  a  deck  activity  not  listed  above  contribute? 

□  YES 

Briefly  describe  activity  below.  □  NO  Go  to  22. 
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(Deck  Operations  -  Mariner  Skiil  &  Knowledge  Limitations,  cont.) 


Step  5.3:  Training  and  Procedures 

Write  the  identification  numbers  of  up  to  three  deck  activities  checked  in  Step  5.2  that  most  contributed  to  the  casualty. 
(Example:  Activity  1:  10a,  Activity  2:  13b,  Activity  3:  16a.)  Then,  complete  the  remaining  items  under  each  listed  activity. 


22.  Activity  1 : 

27.  Activity  2: 

32.  Activity  3: 

23.  What  training  has  the  mariner  had  to 
prepare  for  Activity  1  ? 

(Check  ali  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

□  Other  training 

28.  What  training  has  the  mariner  had  to 
prepare  for  Activity  2? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

□  Other  training 

33.  What  training  has  the  mariner  had 
to  prepare  for  Activity  3? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

□  Other  training 

24.  Briefly  describe  the  mariner’s  most 
relevant  training  for  Activity  1. 

29.  Briefly  describe  the  mariner’s  most 
relevant  training  for  Activity  2. 

34.  Briefly  describe  the  mariner’s  most 
relevant  training  for  Activity  3. 

25.  How  long  has  it  been  since  the 
mariner  received  this  Activity  1 
training? 

years  and  months 

30.  How  long  has  it  been  since  the 
mariner  received  this  Activity  2 
training? 

years  and  months 

35.  How  long  has  it  been  since  the 
mariner  received  this  Activity  3 
training? 

years  and  months 

26.  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  1 . 

31 .  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  2. 

36.  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  3. 

Are  procedures  adequate?  DYES  DNO 

Are  procedures  adequate?  DYES  DNO 

Are  procedures  adequate?  DYES  DNO 

Step  5.4:  Conclusions  and  Recommendations 

Respond  to  items  37-38  after  completing  Step  5.3. 


37.  If  the  mariner  lacks  skill  or  knowledge  in  any  activity 
(1  to  3),  complete  37 and  33;  otherwise,  end  this 
report  (NOT  skill  or  knowledge  related). 

Activity  1 

Activity  2 

Activity  3 

a.  The  mariner  most  likely  lacks  skill  in  this 
activity. 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

b.  The  mariner  most  likely  lacks  knowledge  in 
this  activity. 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

38.  What  could  be  done  to  improve  this  mariner’s  skill  and/or  knowledge,  or  to  improve  established  procedures  and  reduce 
casualties? 

Minimum: 

Ideai: 
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Engineering  Operations  -  Mariner  Skill  &  Knowledge  Limitations 


Please  complete  this  form  separately  for  each  person  whose  engineering  activities  contributed  to  the  casualty. 

Step  5.1:  Maritime  Work  History  of  Contributing  Mariner _ 


1.  Mariner’s  name: 

2.  Job  position  at  time  of  casualty: 

3.  years  months  in  this  industry. 

4.  years  months  with  this  company. 

5.  years  months  in  present  oosition. 

6.  years  months  on  present  vessel  or  facility. 

7.  years  months  on  present  route. 

8.  Current  licenses/documents  (N/A  if  not  applicable): 

Step  5.2:  Mariner’s  Actions,  Inaction,  or  Decisions  Contributing  to  the  Casualty 


9.  Briefly  describe  how  this  person’s  specific  engineering  actions,  inaction,  or  decisions  contributed  to  the  casualty: 


Now,  check  IZI  all  engineering  activities  (10-16) )  that  directly  contributed  to  the  casualty. 


10.  Did  changing  engineering  watch  activities  contribute  to 
casualty? 

□  a.  Check  and  acknowledge  standing  orders,  night  orders, 

and  special  information 

□  b.  Check  status  of  ship’s  equipment _ 

11.  Did  engineering  systems  operations  activities  contribute 
to  casualty? 

□  a.  Operate  main  propulsion  system  (engines,  boilers,  fuel 

and  steering 

□  b.  Operate  generating  and  electrical  systems 

□  c.  Operate  motors,  pumps,  and  lubrication  systems _ 

12.  Did  engineering  systems  inspection  and  testing 
activities  contribute  to  casualty? 

□  a.  Inspect  and  test  main  propulsion  system  (engines, 

boilers,  fuel,  and  steering) 

□  b.  Inspect  and  test  generating  and  electrical  systems 


13.  Did  routine,  scheduied,  and  preventive  maintenance 

activities  contribute  to  casualty? 

□  a.  Maintain  main  propulsion  system  (engines,  boilers, 

fuel,  and  steering) 

□  b.  Maintain  generating  and  electrical  systems _ 

14.  Did  unscheduled,  corrective  repair  activities  contribute 
to  casualty? 

□  a.  Repair  main  propulsion  system  (engines,  boilers,  fuel, 

and  steering) 

□  b.  Repair  generating  and  electrical  systems _ 

15.  Did  engineering  communications  activities  contribute  to 
casualty? 

□  a.  Communicate  and  coordinate  effectively  among  the 

_ vessel’s  crew  (Bridge,  Engine,  and  Deck) _ 

16.  Did  engineering  activity  not  listed  above  contribute  to 
casualty? 


□  YES  Check  all  activities  that  apply.  □  NO  Goto  11. 

□  c.  Assess  traffic  and  weather  conditions 

□  d.  Ensure  that  watch  is  relieved 


□  YES  Check  all  activities  that  apply.  □  NO  Go  to  12. 

□  d.  Operate  service  equipment  (evaporators,  refrigeration, 

heating,  AC,  sewage,  and  garbage  treatment) 

□  e.  Load,  discharge,  or  transfer  fuel  between  tanks 


□  YES  Check  all  activities  that  apply.  □NO  Go  to  13. 

□  c.  Inspect  and  test  motors,  pumps,  and  lubrication 

systems 

□  d.  Inspect  and  test  service  equipment  (evaporators, 

refrigeration,  heating,  AC,  sewage,  and  garbage 
_ treatment) _ 

□  YES  Check  all  activities  that  apply.  □NO  Goto  14. 

□  c.  Maintain  motors,  pumps,  and  lubrication  systems 

□  d.  Maintain  service  equipment  (evaporators,  refrigeration, 

_ heating,  AC,  sewage,  and  garbage  treatment) _ 

□  YES  Check  all  activities  that  apply.  □NO  Goto  15. 

□  c.  Repair  motors,  pumps,  and  lubrication  systems 

□  d.  Repair  service  equipment  (evaporators,  refrigeration, 

_ heating,  AC,  sewage,  and  garbage  treatment) _ 

□  YES  Check  all  activities  that  apply.  □NO  Goto  16. 

□  b.  Communicate  and  coordinate  effectively  among  the 

_ engineering  crew _ 

□  YES  Briefly  describe  activity  below.  □NO  Go  to  17. 


Working  Group  1  -  HFW2002 


Page  131  of  141 


Houston,  Texas 


Human  Factors  in  Incident  Investigation  and  Analysis 


(Engineering  Operations  -  Mariner  Skill  &  Knowledge  Limitations,  cont.) 

Step  5.3:  Training  and  Procedures 

Write  the  identification  numbers  of  up  to  three  engineering  activities  checked  in  Step  5.2  that  most  contributed  to  the  casualty. 
(Example:  Activity  1:  10a.  Activity  2:  13b.  Activity  3:  16a.)  Then,  complete  the  remaining  items  under  each  listed  activity. 


17.  Activity  1: 

22.  Activity  2: 

27.  Activity  3: 

18.  What  training  has  the  mariner  had  to 
prepare  for  Activity  1  ? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

□  Other  training 

23.  What  training  has  the  mariner  had  to 
prepare  for  Activity  2? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

□  Other  training 

28.  What  training  has  the  mariner  had 
to  prepare  for  Activity  3? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

□  Other  training 

19.  Briefly  describe  the  mariner’s  most 
relevant  training  for  Activity  1. 

24.  Briefly  describe  the  mariner’s  most 
relevant  training  for  Activity  2. 

29.  Briefly  describe  the  mariner’s  most 
relevant  training  for  Activity  3. 

20.  How  long  has  it  been  since  the 
mariner  received  this  Activity  1 
training? 

years  and  months 

25.  How  long  has  it  been  since  the 
mariner  received  this  Activity  2 
training? 

years  and  months 

30.  How  long  has  it  been  since  the 
mariner  received  this  Activity  3 
training? 

years  and  months 

21 .  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  1 . 

26.  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  2. 

31 .  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  3. 

Are  procedures  adequate?  DYES  DNO 

Are  procedures  adequate?  DYES  DNO 

Are  procedures  adequate?  DYES  DNO 

Step  5.4:  Conclusions  and  Recommendations 

Respond  to  items  32-33  after  completing  Step  5.3. 


32.  If  the  mariner  lacks  skill  or  knowledge  in  any  activity 
(1  to  3),  complete  32 and  33;  otherwise,  end  this 
report  (NOT  skill  or  knowledge  related). 

Activity  1 

Activity  2 

Activity  3 

a.  The  mariner  most  likely  lacks  skill  in  this 
activity. 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

b.  The  mariner  most  likely  lacks  knowledge  in 
this  activity. 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

33.  What  could  be  done  to  improve  this  mariner’s  skill  and/or  knowledge,  or  to  improve  established  procedures  and  reduce 
casualties? 

Minimum: 

Ideal: 
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Safety  &  Emergency  Operations  -  Mariner  Skill  &  Knowledge  Limitations 

Please  complete  this  form  separately  for  each  person  whose  safety  and  emergency  activities  contributed  to  the  casualty. 

Step  5.1:  Maritime  Work  History  of  Contributing  Mariner _ 


1. 

Mariner’s  name: 

2. 

Job  position  at  time  of  casuaity: 

3. 

years 

_  months  in  this  industry. 

4. 

years 

_ months  with  this  company. 

5. 

years 

_  months  in  present  position. 

6. 

years 

_ months  on  present  vessei  or  faciiity. 

7. 

years 

months  on  present  route. 

8. 

Current  iicenses/documents  (N/A  if  not  appiicabie): 

Step  5.2:  Mariner’s  Actions,  Inaction,  or  Decisions  Contributing  to  the  Casualty 


9.  Briefiy  describe  how  this  person’s  specific  safety  and  emergency  actions,  inaction,  or  decisions  contributed  to  the  casuaity: 

Now,  check  0  all  safety  and  emergency  activities  (10-18) )  that  directly  contributed  to  the  casualty. 

10.  Did  general  safety  activities  contribute  to  casuaity? 

□  a.  Embark  and  disembark  vessei  safeiy 

□  b.  Waik  about  vessei  safeiy 

□  YES 

□  c. 

Check  all  activities  that  apply. 
Perform  off-duty  activities  safeiy 

□  NO  Goto  11. 

11.  Did  safety  equipment  inspection  and  service  activities 

□  YES 

Check  all  activities  that  apply. 

□  NO  Go  to  12. 

contribute  to  casuaity? 

□  a.  inspect  and  service  fire  detection  equipment 

□  d. 

inspect  and  service  survivai  craft 

□  b.  inspect  and  service  fire  extinguishing  equipment 

□  e. 

inspect  and  service  emergency  generator,  batteries, 

□  c.  inspect  and  service  iifesaving  equipment,  iocating 

etc. 

devices,  and  fiotation  devices 

12.  Did  controlling  and  fighting  fires  activities  contribute  to 

□  YES 

Check  all  activities  that  apply. 

□  NO  Go  to  13. 

casuaity? 

□  a.  Estabiish  and  maintain  a  Fire  Safety  Pian 

□  d. 

Use  fire-fighting  equipment  and  procedures 

□  b.  Organize  and  conduct  fire  driiis 

□  e. 

Maintain  escape  routes 

□  c.  identify  the  type  of  fire 

13.  Did  confined  space  rescue  activities  contribute  to 

□  YES 

Check  all  activities  that  apply. 

□  NO  Go  to  14. 

casuaity? 

□  a.  Locate  individuai{s) 

□  c. 

Use  breathing  apparatus  and  other  required  equipment 

□  b.  Estabiish  a  rescue  pian 

□  d. 

Maintain  back-up  personnei  and  escape  routes 

14.  Did  person  overboard  procedures  contribute? 

□  YES 

Check  all  activities  that  apply. 

□  NO  Go  to  15. 

□  a.  initiate  warning 

□  c. 

Maneuver  vessei 

□  b.  Locate  person  overboard 

□  d. 

Bring  person  aboard 

15.  Did  abandon  vessei  operations  contribute  to  casuaity? 

□  YES 

Check  all  activities  that  apply. 

□  NO  Go  to  16. 

□  a.  Don  survivai  suits  and  personai  fiotation  devices 

□  c. 

Empioy  iocating  devices  properiy 

□  b.  Launch,  ioad,  and  maneuver  iifeboats  and  iife  rafts 

16.  Did  emergency  medical  and  life-saving  procedures 

□  YES 

Check  all  activities  that  apply. 

□  NO  Goto  17. 

activities  contribute  to  casuaity? 

□  a.  Use  medicai  chest  and  first  aid  items 

□  b. 

Appiy  First  Aid/CPR 

17.  Did  emergency  communications  activities  contribute? 

□  YES 

Check  all  activities  that  apply. 

□  NO  Go  to  18. 

□  a.  Estabiish  and  maintain  communications  with  crew 

□  d. 

Estabiish  emergency  communications  with  shore 

□  b.  Estabiish  and  maintain  communications  with 

authorities 

passengers 

□  e. 

Monitor  GMDSS  and  other  emergency  frequencies  as 

□  c.  Estabiish  and  maintain  emergency  communications 

required 

with  other  vesseis 

18.  Did  safety  and  emergency  activity  not  listed  above 

□  YES 

Briefly  describe  activity  below. 

□  NO  Go  to  19. 

contribute  to  casuaity? 
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(Safety  &  Emergency  Operations  -  Mariner  Skill  &  Knowledge  Limitations,  cont.) 

Step  5.3:  Training  and  Procedures 

Write  the  identification  numbers  of  up  to  three  safety  and  emergenoy  activities  checked  in  Step  5.2  that  most 
contributed  to  the  oasuaity.  (Exampie:  Aotivity  1 :  10a,  Activity  2:  13b.  Activity  3:  Wa.)  Then,  compiete  the  items 
under  each  tisted  activity. _ 


19.  Activity  1: 

24.  Activity  2: 

29.  Activity  3: 

20.  What  training  has  the  mariner  had  to 
prepare  for  Activity  1  ? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

25.  What  training  has  the  mariner  had  to 
prepare  for  Activity  2? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

30.  What  training  has  the  mariner  had 
to  prepare  for  Activity  3? 

(Check  all  that  apply.) 

□  No  training  of  any  kind 

□  Informal  on-the-job  training 

□  Formal,  structured  on-the-job 
training  and  supervision 

□  Coast  Guard-approved  course 

□  Maritime  trade  school  training 

□  Maritime  college  or  academy 
training 

□  Other  training 

□  Other  training 

□  Other  training 

21 .  Briefly  describe  the  mariner’s  most 

26.  Briefly  describe  the  mariner’s  most 

31 .  Briefly  describe  the  mariner’s  most 

relevant  training  for  Activity  1. 

relevant  training  for  Activity  2. 

relevant  training  for  Activity  3. 

22.  How  long  has  it  been  since  the 
mariner  received  this  Activity  1 
training? 

years  and  months 

27.  How  long  has  it  been  since  the 
mariner  received  this  Activity  2 
training? 

years  and  months 

32.  How  long  has  it  been  since  the 
mariner  received  this  Activity  3 
training? 

years  and  months 

23.  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  1 . 

28.  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  2. 

33.  Briefly  describe  established  vessel 
procedures,  regulations,  or  common 
practices  that  guide  mariner 
performance  of  Activity  3. 

Are  procedures  adequate?  DYES  DNO 

Are  procedures  adequate?  DYES  DNO 

Are  procedures  adequate?  DYES  DNO 

Step  5.4:  Conclusions  and  Recommendations 

Respond  to  items  34-35  after  completing  Step  5.3. 


34.  If  the  mariner  lacks  skill  or  knowledge  in  any  activity 


(1  to  3),  complete  34  and  35;  otherwise,  end  this 
report  (NOT  skill  or  knowledge  related). 

Activity  1 

Activity  2 

Activity  3 

a.  The  mariner  most  likely  lacks  skill  in  this 
activity. 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

b.  The  mariner  most  likely  lacks  knowledge  in 
this  activity. 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

□  TRUE  □  FALSE 

35.  What  could  be  done  to  improve  this  mariner’s  skill  and/or  knowledge,  or  to  improve  established  procedures  and  reduce 
casualties? 

Minimum: 


Ideal: 
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Appendix  H.  Human  Factors  Investigation  Questions 

The  following  is  taken  from  “Role  of  the  Human  Element  in  Maritime  Casualties,”  by  the  Joint 
ILO/IMO  adhoc  Working  Group  on  Investigation  of  Human  Factors  in  Maritime  Casualties, 
Maritime  Safety  Committee,  MSC  69/13/1  ([MSC],  1998,  Annex  4,  Appendix  2).  These  are 
questions  designed  to  help  the  casualty  investigator  ask  questions  appropriate  to  discovering 
human  errors  which  may  have  contributed  to  an  incident.  While  no  list  of  questions  can  be 
comprehensive,  this  one  provides  a  good  set  of  initial  inquiries  into  the  events  and  underlying 
causes.  Investigators  can  use  these  to  explore  many  facets  surrounding  the  incident,  choosing 
relevant  areas  for  follow-up.  Even  though  the  questions  below  assume  an  accident  to  a 
commercial  ship,  the  questions  can  easily  be  tailored  to  investigate  incidents  on  any  type  of 
facility  or  vessel.  The  text  of  the  MSC  document  is  provided  below. 


Note:  The  following  questions  are  designed  to  aid  the  investigator  while  investigating  for 
human  factors,  particularly  fatigue.  Skilful  [sic]  questioning  can  help  the  investigator  eliminate 
irrelevant  lines  of  inquiry  and  focus  on  areas  of  greater  potential  significance. 

The  order  in  which  the  questions  should  be  asked  will  depend  on  who  is  being 
interviewed  and  on  his  or  her  willingness  and  ability  to  describe  personal  behaviour  and 
personal  impressions.  Also,  it  may  be  necessary  to  verify,  cross-check  or  augment  information 
received  from  one  person  by  interviewing  others  on  the  same  points. 

These  areas  of  inquiry  can  be  used  in  training  investigators  as  well  as  in  planning 
interviews.  The  following  questions  are  not  intended  as  a  checklist,  and  some  may  not  be 
relevant  in  the  investigation  of  a  particular  accident. 

1  Safety  Policy 

.1  Does  the  company  have  a  written  safety  policy? 

.2  Is  there  a  designated  person  for  shipboard  safety  matters  in  the  company? 

.3  When  did  a  company  Representative  last  visit  the  vessel  or  when  were  you  last  in 
contact  with  the  company? 

.4  When  were  you  last  provided  safety  training?  What  was  the  training  and  how  was  it 
provided? 

.5  When  was  the  last  emergency  drill  (e.g.,  fire,  abandon  ship,  man-overboard, 
pollution  response,  etc)  and  what  did  you  do  during  the  drill? 

.6  Was  appropriate  personal  protective  equipment  provided  and  did  you  use  it? 

.7  Are  you  aware  of  any  personal  accidents  which  occurred  on  board  in  the  period 
prior  to  the  accident? 

2  Activities  prior  to  incident 

.1  (If  the  ship  was  leaving  port  at  the  time  of  the  accident)  In  general,  how  did  you 
spend  your  time  while  the  ship  was  in  port? 

.2  (If  the  ship  was  approaching  port  or  at  sea  at  the  time  of  the  accident)  How  long 
has  the  ship  been  on  passage  since  its  last  port  or  terminal  operation? 
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.3  What  were  you  doing  immediately  prior  to  coming  on  watch  or  reporting  for  duty, 
and  for  how  long?  Recreational  activity?  Physical  exercise?  Sleeping?  Reading? 
Watching  T.V.?  Eating?  Paperwork?  Travelling  to  vessel? 

.4  Specifically  what  were  you  doing  approximately  4  hours  .  1  hour .  30 

minutes  .  before  the  accident? 

.5  What  evolution  was  the  ship  involved  in  when  the  accident  occurred?  What  was 
your  role  during  that  evolution? 

.6  Immediately  prior  to  the  accident,  what  were  you  thinking  about? 

.7  At  any  time  before  the  accident,  did  you  have  any  indication  that  anyone  was  tired 
or  unable  to  perform  their  duty? 

3  Duties  at  the  time  of  accident 

.1  Where  were  you  on  the  ship  when  the  accident  occurred? 

.2  What  specific  job  or  duty  were  you  assigned  at  the  time?  By  whom?  Did  you 
understand  your  assignment?  Did  you  receive  any  conflicting  orders? 

.3  How  often  have  you  performed  this  job  in  the  past  (on  the  specific  ship  involved  in 
the  accident)? 

4  Actual  behaviour  at  time  of  accident 

.1  Precisely  where  were  you  located  at  the  time  of  the  accident? 

.2  What  specific  task  were  you  performing  at  the  time  of  the  accident? 

.3  Had  you  at  any  time  since  reporting  for  duty  found  that  you  could  not  concentrate 
(focus  your  attention/keep  your  mind)  on  a  task  you  were  trying  to  perform? 

5  Training/Education/Certification/Professional  Experience 

.1  How  long  have  you  been  assigned  to  this  ship?  Have  you  requested  that  your 
assignment  be  lengthened  or  shortened? 

.2  How  long  have  you  filled  your  crew  position?  What  other  crew  positions  have  you 
held  on  this  ship? 

.3  How  long  have  you  held  the  certificate  indicating  your  qualifications? 

.4  Before  being  assigned  to  this  ship,  did  you  work  on  other  ships?  If  so,  what  crew 
positions  have  you  held? 

.5  What  is  the  longest  time  you  have  been  to  sea  in  a  single  voyage?  How  long  have 
you  been  at  sea  on  this  passage?  What  was  your  longest  single  passage? 

6  Physical  condition 

.1  Were  you  feeling  ill  or  sick  at  any  time  in  the  24  hours  immediately  before  the 
accident?  If  so,  what  symptoms  did  you  have?  Did  you  have  a  fever,  vomit,  feel 
dizzy,  other?  Also,  did  you  tell  anyone?  What  do  you  believe  the  cause  was? 

.2  When  was  the  last  meal  you  had  prior  [to]  the  accident?  What  did  you  eat?  Was  it 
adequate? 

.3  Do  you  exercise  regularly  while  onboard?  When  did  you  last  exercise  (before  the 
accident)?  How  long  was  the  session? 


7  Psychological,  emotional,  mental  condition  and  employment  conditions 
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.1  When  was  the  last  time  you  felt  cheerful  or  elated  onboard  the  ship,  and  what  were 
the  circumstances  that  generated  this  emotion? 

.2  When  was  the  last  time  you  were  sad  or  depressed  or  dejected,  on  board  the  ship? 
Why?  Did  you  talk  about  it  with  anyone  else? 

.3  Have  you  had  to  make  any  difficult  personal  decisions  recently?  Have  you  had  any 
financial  or  family  worries  on  your  mind  recently? 

.4  Have  you  been  criticized  for  how  you  are  doing  your  work  lately?  By  whom?  Was  it 
justified? 

.5  What  was  the  most  stressful  situation  you  had  to  deal  with  on  the  voyage  (prior  to 
the  accident)?  When  did  the  situation  occur?  How  was  it  resolved? 

.6  What  are  the  contractual  arrangements  for  all  crewmembers? 

.7  Have  there  been  any  complaints  or  industrial  action  in  the  last  (1 2)  months? 

8  Workload/Complexity  of  Tasks 

.1  What  is  the  shipboard  organization? 

.2  Is  the  shipboard  organization  effective? 

.3  What  is  your  position  in  the  shipboard  organization  (i.e.,  who  do  you  work  for,  report 
to  or  assign  duties  to)? 

.4  What  is  the  nature  of  your  work?  Sedentary?  Physically  demanding? 

.5  Was  anyone  involved  in  the  accident  impaired  due  to  heavy  workload? 

9  Work-period/rest-period/recreation  pattern 

.1  What  is  your  normal  duty  schedule? 

.2  Are  you  a  day  worker  or  a  watchstander? 

.3  What  was  your  duty  schedule  on  the  day  before  the  accident  and  during  the  week 
before  the  accident? 

.4  Were  you  on  overtime  at  the  time  of  the  accident? 

.5  How  long  had  you  been  on  duty,  or  awake  performing  other  work,  at  the  time  of  the 
accident? 

.6  When  was  your  lat  period  of  sleep?  How  long  did  it  last?  How  often  did  you 
awaken  during  your  last  sleep  period?  Did  you  awaken  refreshed?  If  not,  what 
would  have  made  your  sleep  period  more  restful? 

.7  How  do  you  normally  spend  your  off-duty  time  while  on  board?  Play  cars?  Read? 
Listen  to  music?  Watch  T.V.?  Other? 

.8  When  was  your  last  extended  period  of  off  duty  time  when  you  were  able  to  rest? 

1 0  Relationship  with  other  crewmembers  and  superiors/subordinates 

.1  Who  among  the  crew  would  you  consider  to  be  a  friend? 

.2  Do  you  find  any  members  of  the  crew  unpleasant  to  be  with? 

.3  Do  you  have  difficulty  talking  with  any  of  the  crewmembers  because  of  language 
barriers? 

.4  Have  any  new  crewmembers  recently  joined  the  ship?  Have  you  had  a  chance  to 
get  acquainted  with  them? 

.5  Did  you  have  any  argument  recently  with  another  crewmember? 

.6  In  an  emergency,  would  you  trust  your  fellow  crewmembers  to  come  to  your 
assistance? 
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.7  Has  another  crewmember  ever  offered  to  take  your  place  on  watch  or  perform  a 
duty  for  you  to  let  you  get  some  extra  rest? 

.8  What  was  the  subject  of  your  last  conversation  with  another  crewmember  before 
reporting  for  duty  (when  the  accident  occurred)? 

.9  Have  you  talked  with  any  other  crewmembers  since  the  accident?  If  so,  what  was 
the  subject  of  your  conversation?  Have  you  talked  with  anyone  else  about  the 
accident  prior  to  being  interviewed? 

1 1  Living  conditions  and  shipboard  environment 

.1  Do  you  consider  your  personal  area  on  board  the  ship  to  be  comfortable?  If  not, 
how  would  you  like  it  to  [be]  improved? 

.2  Prior  to  the  accident,  did  you  have  any  difficulty  resting  as  a  result  of  sever  weather, 
noise  levels,  heat/cold,  ship’s  motion,  etc.? 

12  Manning  levels 

.1  Is  the  manning  level  sufficient  in  your  opinion  for  the  operation  of  the  vessel? 

1 3  Master’s  standing  orders 

.1  Are  there  written  standing  orders  to  the  whole  crew  complement  from  the  Master? 

.2  Did  the  Master/Chief  Engineer  provide  written  or  verbal  standing  orders  to  the 
watchkeeping  personnel? 

.3  Were  the  orders  in  conflict  with  the  company  safety  policy? 

1 4  Level  of  automation/reliability  of  equipment 

.1  In  your  opinion,  was  the  system  reliable? 

.2  Were  there  earlier  failures  in  the  system? 

.3  Were  the  failures  repaired  by  the  crew  or  shore-based  workers? 

1 5  Ship  design,  motion/cargo  characteristics 

.1  Did  you  observe  anything  out  of  the  ordinary  on  this  passage  concerning  the  ship 
design,  or  motion  or  cargo  characteristics? 

Questions  16-24  [25]  are  EXAMPLES  OF  QUESTIONS  THAT  MAY  BE  DIRECTED  TO 

SHORESIDE  MANAGEMENT 

1 6  Scheduling  of  work  and  rest  periods 

.1  What  is  the  company’s  work  schedule  and  relief  policy? 

17  Manning  level 

.1  How  is  the  manning  level  determined  for  your  fleet? 

1 8  Watchkeeping  practices 

.1  Do  you  require  the  Master  to  stand  watch? 
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.2  Do  you  leave  the  watchkeeping  practices  to  the  discretion  of  the  Master? 

1 9  Assignment  of  duties 

.1  Do  you  leave  this  matter  to  the  Master? 

20  Shore-ship-shore  support  and  communications 
.1  How  do  you  support  the  vessel’s  Master? 

21  Management  policies 

.1  Does  the  company  have  a  written  safety  policy? 

22  Voyage  planning  and  port  call  schedules 
.1  How  does  the  Master  plan  the  voyages? 

23  Recreational  facilities 

.1  Are  welfare/recreational  services  and  facilities  provided  on  board? 

24  Contractual  and/or  industrial  arrangements  and  agreements 

.1  What  are  the  contractual  agreements  for  all  crewmembers? 

.2  Have  there  been  any  complaints  or  industrial  action  in  the  last  (1 2)  months? 

25  National/international  requirements 

.1  Are  the  management/Master  complying  with  the  requirements  and  recommend¬ 
ations  of  the  applicable  international  conventions  and  Flag  State  regulations? 
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Appendix  I.  Norwegian  Petroleum  Directorate  Near-Miss  System 


In  2000,  Norway  instituted  a  near-miss  database  to  assess  risk  levels  in  the  continental  shelf 
offshore  industry.  The  database  contains  reports  on  major  hazards,  occupational  injuries, 
occupational  disease,  cultural  risk  factors,  and  perceived  risks.  The  focus  is  on  preventing  risk 
to  personnel  on  offshore  facilities,  such  as  production  installations,  mobile  drilling  units,  and 
flotels.  A  report,  “Trends  in  Risk  Levels  on  the  Norwegian  Continental  Shelf,”  gives  an  overview 
of  the  near-miss  system  and  findings  to  date.  The  report  can  be  found  on  the  Norwegian 
Petroleum  Directorate  (NPD)  web  site  (http://www.npd.no  ;  click  on  the  British  flag  for  English, 
then  go  to  the  Health,  Environment  &  Safety  (HSE)  page).  This  appendix  gives  a  brief 
presentation  of  the  near-miss  system  and  a  couple  examples  of  the  data,  courtesy  of  Professor 
Jan  Erik  Vinnem. 

The  near-miss  database  is  limited  to  incidents  that  may  have  the  potential  to  cause  major 
accidents,  if  multiple  barrier  failures  occur.  Some  other  incidents  that  are  essential  for 
emergency  preparedness  planning  are  also  covered.  The  operators  on  the  Norwegian 
Continental  Shelf  have  a  duty  (enforced  by  NPD  through  regulations)  to  notify  NPD  about 
injuries,  accidents  and  near-misses  within  a  short  time  after  the  occurrence  of  these  events. 
(For  the  most  serious  incidents,  further  investigation  reports  will  be  required  for  submission.) 
The  cut-off  limits  for  which  incidents  to  report  are  somewhat  loosely  defined,  and  there  are 
significant  differences  between  the  companies,  with  respect  to  reporting  practices.  The 
database  is  based  on  a  subset  of  these  mandatory  reports,  and  includes  those  which  have  been 
extensively  reviewed  and  verified  to  ensure  consistency  and  which  have  established  exposure 
data  (activity  levels). 

The  NPD  classifies  major  hazards  into  eleven  types  (or  DFUs),  shown  below.  Each  DFU 
presents  a  specific,  potentially-serious  hazardous  situation. 

DFU  Event  Scenario 

1  Unignited  hydrocarbon  leak 

2  Ignited  hydrocarbon  leak 

3  Kick/loss  of  well  control 

4  Fire/explosion,  excluding  DFU#2 

5  Vessel  on  collision  course 

6  Drifting  object/vessel  on  collision  course 

7  collision  with  field  related  traffic 

8  Structural  damage 

9  Leak  from  subsea  installation 

1 0  Damage  to  subsea  installation 

1 1  Evacuation  (precautionary/emergency) 
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Although  the  near-miss  database  was  not  formally  brought  on-line  until  2000,  the  NPD  had 
incident  data  from  several  prior  years.  The  NPD  has  analyzed  yearly  incident  data  in  terms  of 
the  DFUs,  as  shown  in  the  trend  analysis  presented  in  Figure  1-1  (see  Sec.  6.3  for  information 
on  trend  analysis).  It  is  clear  from  the  figure  that  unignited  hydrocarbon  leaks  are  a  primary 
source  of  potential  accidents.  These  data  have  been  further  analyzed  by  size  of  leak  in  Figure 
1-2.  The  NPD  system  demonstrates  how  near-miss  data  can  be  used  to  identify  potential 
hazardous  situations  so  that  the  industry  can  seek  safety  solutions  before  a  significant  accident 
results. 


□  Helicopt  incid,  field 

□  B/ac/mjster 

□  Dam.  subs  Inst 

■  Subs  equipm  leak 

□  Struct,  damage 

□  Coll,  attend  vess. 

□  Drifting  object 

■  Ship  on  coll  course 

□  Qher  fire/expl 

□  Kick 

□  Ign  HC  leak 

□  Unign  HC  leak 


Figure  1-1.  Norwegian  Petroleum  Directorate  Near-Miss  Data.  Six  years  of 
incident  data  for  all  major  hazard  DFUs,  representing  near-misses  at 
all  continental  shelf  offshore  installations. 
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Figure  1-2.  NPD  Data  on  Unignited  Hydrocarbon  Leaks. 

by  size  of  the  leak. 


Data  are  segmented 
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